From: Nikola Kolev <koue@chaosophia.net>
Subject: httpd header drop
To: tech@openbsd.org
Date: Tue, 6 Oct 2026 22:54:15 +0000

Hi @tech,

this is small change how httpd handles 'header drop'.
It's the same approach as 'location block drop':
set return_code 0, call server_abort_http and log in error.log only.

Also add test to regress.

diff --git regress/usr.sbin/httpd/tests/Httpd.pm regress/usr.sbin/httpd/tests/Httpd.pm
index 53fed7204..1851f1457 100644
--- regress/usr.sbin/httpd/tests/Httpd.pm
+++ regress/usr.sbin/httpd/tests/Httpd.pm
@@ -77,6 +77,7 @@ sub new {
 	}
 	print $fh "\n\troot \"/\"";
 	print $fh "\n\tlog style combined";
+	print $fh "\n\theader drop \"User-Agent\" \"crawlbot\"";
 	print $fh  "\n}\n";
 
 	return $self;
diff --git regress/usr.sbin/httpd/tests/args-header-drop.pl regress/usr.sbin/httpd/tests/args-header-drop.pl
new file mode 100644
index 000000000..22898cdba
--- /dev/null
+++ regress/usr.sbin/httpd/tests/args-header-drop.pl
@@ -0,0 +1,18 @@
+use strict;
+use warnings;
+
+our %args = (
+    client => {
+	header => {
+		"User-Agent" => "crawlbot"
+	},
+	nocheck => 1
+    },
+    httpd => {
+	loggrep => {
+	    qr/dropped/ => 1,
+	},
+    },
+);
+
+1;
diff --git regress/usr.sbin/httpd/tests/funcs.pl regress/usr.sbin/httpd/tests/funcs.pl
index 84c96f188..1b9aa9aa0 100644
--- regress/usr.sbin/httpd/tests/funcs.pl
+++ regress/usr.sbin/httpd/tests/funcs.pl
@@ -183,6 +183,7 @@ sub http_request {
 
 sub http_response {
 	my ($self, $len) = @_;
+	return if $self->{nocheck};
 	my $method = $self->{method} || "GET";
 	my $code = $self->{code} || "200 OK";
 
diff --git usr.sbin/httpd/parse.y usr.sbin/httpd/parse.y
index 3da845035..13cb546b7 100644
--- usr.sbin/httpd/parse.y
+++ usr.sbin/httpd/parse.y
@@ -914,6 +914,7 @@ header		: HEADER REMOVE STRING optalways	{
 				YYERROR;
 			}
 
+			hrule->return_code = 0;
 			hrule->name = $3;
 			hrule->value = $4;
 
diff --git usr.sbin/httpd/server_http.c usr.sbin/httpd/server_http.c
index 582f34fb9..4beccbaca 100644
--- usr.sbin/httpd/server_http.c
+++ usr.sbin/httpd/server_http.c
@@ -1511,9 +1511,6 @@ server_response(struct httpd *httpd, struct client *clt)
 	if ((mrule = server_match_header_rule(srv_conf, desc)) != NULL) {
 		switch (mrule->action) {
 		case HEADER_ACTION_DROP:
-			(void)server_log_http(clt, 0, 0);
-			server_close(clt, mrule->return_uri);
-			return (-1);
 		case HEADER_ACTION_RDR:
 		case HEADER_ACTION_RETURN:
 			server_abort_http(clt, mrule->return_code,