title: Using a Header to Filter Proxied Response Headers
body: <p>I have an upstream server that often sets Cookie(s) by returning the "Set-Cookie" response header.</p>
  
  <p>I would like to have an nginx proxy in front of said upstream server:</p>
  
  <pre><code>Browser =&gt; Nginx =&gt; Upstream
  </code></pre>
  
  <p>If the <code>Browser =&gt; Nginx</code> request had the header <code>X-No-Cookies: true</code> I'd like the response from <code>Upstream =&gt; Nginx =&gt; Browser</code> not to contain the <code>Set-Cookie</code> response header. If <code>X-No-Cookies</code> had any other value, I'd lie the <code>Set-Cookie</code> response header to be returned unaltered. <strong>I'm not able to change the response header behavior of the upstream server.</strong></p>
  
  <p>Currently my nginx config is as follows, pay specific attention to the use of the <code>proxy_hide_header</code> directive. I've also echoed the <code>$proxy_hide_header</code> variable in the <code>X-No-Cookies</code> response header.</p>
  
  <pre><code>map $http_x_no_cookies $proxy_hide_header {
    default "";
    "true"  "Set-Cookie";
  }
  
  # Homepage
  server {
    listen 80;
    server_name example.com;
  
    location /api {
      proxy_pass        https://example.com/api;
      proxy_hide_header $proxy_hide_header;
      add_header        "X-No-Cookies" $proxy_hide_header;
    }
  }
  </code></pre>
  
  <p>When I make a request with cURL:</p>
  
  <pre><code>curl \
    http://example.com/api \
    -H 'X-No-Cookies: true' \
    -I
  </code></pre>
  
  <p>I get the following response headers:</p>
  
  <pre><code>Server: nginx/1.12.2
  Date: Thu, 13 Dec 2018 02:26:41 GMT
  Content-Type: application/json
  Content-Length: 2255
  Connection: keep-alive
  Access-Control-Allow-Credentials: true
  Access-Control-Allow-Headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept,Authorization
  Access-Control-Allow-Methods: GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS
  Access-Control-Expose-Headers: Content-Length
  Set-Cookie: foo=bar; Max-Age=2592000; Expires=Sat, 12 Jan 2019 02:26:41 GMT; Path=/; Domain=example.com; Secure
  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
  X-No-Cookies: Set-Cookie
  </code></pre>
  
  <p>Whenever the <code>proxy_hide_header</code> is provided an nginx variable as an argument it seems to have no effect. If I swap the variable for a string (<code>$proxy_hide_header</code> substituted for <code>"Set-Cookie"</code>) I get the desired behaviour - the <code>Set-Cookie</code> response header is omitted.</p>
  
  <p><strong>Edit</strong>: I've pushed the code for this question to GitHub</p>
  
  <ul>
  <li>My original (non-working) implementation is <a href="https://github.com/aren55555/nginx-dynamic-proxy_hide_header/blob/master/nginx/nginx.conff#L118" rel="nofollow noreferrer">here</a></li>
  <li>Ivan Shatsky's solution is <a href="https://github.com/aren55555/nginx-dynamic-proxy_hide_header/blob/ivan-shatsky-solution/nginx/nginx.conf#L113" rel="nofollow noreferrer">here</a></li>
  </ul>