title: Nginx passing a HTTP header through an error_page redirection
body: <p>tl:dr, if a request is redirected using a nginx error_page directive, how can I make sure that a custom-header is passed with this redirect.</p>
  
  <p>I'm currently implementing a system where nginx authenticates against an LDAP server an acts as a reverse-proxy. It's based on this <a href="https://www.nginx.com/blog/nginx-plus-authenticate-users/" rel="nofollow noreferrer">https://www.nginx.com/blog/nginx-plus-authenticate-users/</a>
  The way it works is that, it has a all encompassing server block, that sends the request to an authentication page running on another port, this sends back either a 403 or a 200 based on the contents of a cookie. If this is a 403, the user gets sent to a login page, if 200 on to their destination.</p>
  
  <p>The example nginx conf is here:</p>
  
  <pre><code>location / {
      auth_request /auth-proxy;
  
      # redirect 401 to login form
      error_page 401 =200 /login;
  
      proxy_pass http://backend/;
  }
  
  location /login {
      proxy_pass http://backend/login;
      # Login service returns a redirect to the original URI
      # and sets the cookie for the ldap-auth daemon
      proxy_set_header X-Target $request_uri;
  }
  
  location = /auth-proxy {
      internal;
  
      # The ldap-auth daemon listens on port 8888, as set
      # in nginx-ldap-auth-daemon.py.
      # Change the IP address if the daemon is not running on
      # the same host as NGINX/NGINX Plus.
      proxy_pass http://127.0.0.1:8888;
  }
  </code></pre>
  
  <p>The problem is, I've made an alteration that makes the authentication part time out and return a 403 code, regardless of whether the cookie is valid or not. However I want to let the user know this has happened on the login page, so the python authentication code sets X-authenticationfail header with the error value in it.</p>
  
  <p>I've checked this works by using curl to send a timed out cookie to the authentication code, and read the header back. However this header has disappeared when the login python code is called. I think this is due to nginx not forwarding it. I've tried to include the lines "proxy_set_header X-authenticationfail $http_x_authenticationfail;", "add_header X-authenticationfail "test" always;" before the error_page directive, but this has no effect. I've also tried "proxy_pass_header X-authenticationfail" in the same location but this also failed.</p>
  
  <p>The server block has "underscores_in_headers on" set, and "proxy_pass_request_headers on" set. In the login block, placing "proxy_set_header X-authenticationfail "testvalue";" got the value to the login python code and from there back to the browser.</p>
  
  <p>Thanks for getting this far! </p>