From: Kirill A. Korinsky <kirill@korins.ky>
Subject: Re: httpd: add custom HTTP header support #2
To: Rafael Sadowski <rafael@sizeofvoid.org>
Cc: tech@openbsd.org, bentley@openbsd.org, stu@spacehopper.org
Date: Mon, 13 Jul 2026 02:16:58 +0200

On Sat, 11 Jul 2026 16:12:46 +0200,
Rafael Sadowski <rafael@sizeofvoid.org> wrote:
> 
> I think this is a solid first version for that feature. We'll certainly
> find out about more edge cases through user feedback ... or maybe not ;)
> 

Here first pass for review. I haven't spent much time on this. I may be wrong.

> +	TAILQ_FOREACH(hdr, &parent_srv->srv_conf.headers, entry) {
> +		if (header_exists(srv_conf, hdr->name)) {
> +			DPRINTF("%s: skipping header \"%s\" from parent "
> +			    "\"%s\", overridden in location \"%s\"",
> +			    __func__, hdr->name,
> +			    parent_srv->srv_conf.name, srv_conf->location);
> +			continue;
> +		}

What happens with duplicated headers? Multiple Set-Cookie is good example.

> @@ -1050,6 +1063,7 @@ server_abort_http(struct client *clt, unsigned int code, const char *msg)
>  	free(hstsheader);
>  	free(clenheader);
>  	free(bannerheader);
> +	free(customheaders);

I think this code is reached only on error, and it makes customheaders leaks
on sucess.

And next things which I not yet sure. I think that roughly 25 directives
exceed the 16K imsg limit because every one is fixed 664 byte structure nad
it is packed into one message.

What seems worse: call sites ignore the resulting failure, so reload can
succeed with all custom headers absent.

-- 
wbr, Kirill