title: nginx rails send_file - Duplicate headers received from server
body: <p>I have set up our Rails app to serve files via <code>send_file</code> and since we dont want to keep our app busy serving the file we hand that off to Nginx with the <code>X-Accel-Redirect</code> header. For that i set <code>config.action_dispatch.x_sendfile_header = 'X-Accel-Redirect'</code> in my <code>production.rb</code> file as well as setup my nginx.conf like this:</p>
  
  <pre><code># In order to get the site running
  # symlink this file to /etc/nginx/sites-enabled/production
  
  upstream unicorn-production {
    server unix:/tmp/unicorn.sock fail_timeout=0;
  }
  
  server {
    listen 3000;
    server_name production.localhost;
    root /home/deployer/apps/production/current/public;
    access_log /var/log/nginx/production_access.log;
    rewrite_log on;
  
    try_files $uri/index.html $uri @unicorn;
  
    location ~ ^/downloads/(.*)$ {
      internal;
      alias /home/deployer/downloads/$1;
    }
  
    location @unicorn {
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_redirect off;
      proxy_pass http://unicorn-production;
  
      proxy_set_header  X-Sendfile-Type   X-Accel-Redirect;
      proxy_set_header  X-Accel-Mapping   /downloads/=/home/deployer/downloads/;
  
      proxy_connect_timeout 90;
      proxy_send_timeout 90;
      proxy_read_timeout 90;
    }
  
    error_page 500 502 503 504 /500.html;
    client_max_body_size 4G;
    keepalive_timeout 10;
  }
  </code></pre>
  
  <p>and in my controller action i do something like:
  <code>send_file "/home/deployer/downloads/testfile.foo"</code></p>
  
  <p>.</p>
  
  <p>This should all work in theory but when i visit <code>mysite.com/mycontroller/download</code> Chrome tells me <code>Duplicate headers received from server: Error 349 (net::ERR_RESPONSE_HEADERS_MULTIPLE_CONTENT_DISPOSITION): Multiple Content-Disposition headers received. This is disallowed to protect against HTTP response splitting attacks.</code></p>
  
  <p>Any help very appreciated.</p>