Rails 4.2.6 + nginx + puma session store and custom header serves first user data which made request

Question

I have problem with nginx + puma or problem ruby Thread that after adding nginx, server show first user with custom header Forwarded from other app HTTP_MY_APP_REQUEST_USER who did the request, for example if I Henry make request first after starting server with custom header, then other person Jane, request It's still my user data.

I'm not sure where problem is This code with niginx? Or Rails session_store :active_record_store

Tried to add add_header Cache-Control "no-cache, no-store, must-revalidate"; nothing changes. Requesting directly puma, it acts correctly, I can see two different users Henry and Jane.

If you have same IP Nginx servers cookie from memory? application_controller.rb

  def check_authentication(method_name)
    begin
      user_id = (request.headers['HTTP_MY_APP_REQUEST_USER'].to_i / 317) rescue 0
      # Thread.current is used other places to check user 
      Thread.current[:user_id] = (user_id > 0) ? user_id : session[:user].counter
    end
  end

Nginx server conf

upstream puma {
   server 0.0.0.0:3000;
}

server {
    listen 9100;
    server_name localhost;
    client_max_body_size 100m;
    gzip             on;
    gzip_comp_level  4;
    gzip_min_length  1000;
    gzip_proxied     no-cache no-store;
    gzip_types       text/plain application/javascript application/json application/x-javascript text/xml text/css application/xml text/javascript;
    keepalive_timeout 10;
    proxy_cache_key "$scheme$request_method$host$request_uri";
    server_tokens off;
    add_header Cache-Control "no-cache, no-store, must-revalidate";
    add_header Pragma "no-cache";
    add_header Expires 0;  



    root /home/apps/server/current/public;

    location / {
        try_files $uri @puma;
    }

    location @puma {
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $host;
        proxy_redirect off;
        proxy_pass http://puma;
    }

    error_log /var/log/nginx/error.log;
    access_log /var/log/nginx/access_log;
}

Any Idea what can cause this? Many thanks in advance!

Answer 1

Problem was in Custom header with underscore,underscore headers are not allowed by default!

HTTP_MY_APP_REQUEST_USER

adding underscores_in_headers on; solved this