netbox unit webserver drops http headers with _

[s1sfa]

I'm not exactly sure where the best place to document this is. But I've learned the long way that the reverse proxy webserver cannot send HTTP headers with _. The webserver in the docker image ignores/drops them. The reverse proxy passing the auth header needs to send http headers with - instead.

The headers are case insensitive but it is a bit confusing since all of the netbox config matches the header names with _.

For example I set REMOTE_AUTH_HEADER = 'HTTP_NETBOX_USER' and configured the reverse proxy to send header NETBOX_USER and it didn't work. After some time troubleshooting I learned that unit was dropping this header. I changed the reverse proxy to set the header NETBOX-USER and unit could see the header and remote auth started working.

I think this behaviour could be helpful to mention somewhere in the netbox-docker documentation.

[tobiasge]

This is documented with Nginx Unit here: https://unit.nginx.org/configuration/#settings with the setting discard_unsafe_fields.

[s1sfa]

My idea is that the docker is setup to be the application. In a lot of ways it conceals the actual applications under the hood. It takes reading source code or a couple of mentions in obscure places in the wiki to know what the underlying web server even is.

This seems to be a default for most webservers so it may be more appropriate to note to add in the standard netbox config documentation. Based on this I also assume it is quite common knowledge for everyone experienced operation web servers.

A broader catch-all idea could be adding something in troubleshooting section for http issues see Nginx Unit documentation: https://unit.nginx.org/

Or this discussion can serve as the documentation and is sufficient for anyone searching a similar problems.