Skip to content

Embed: proxy buffers for the subscribe response headers #1548

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
feruzm merged 1 commit into from
Aug 20, 2026
Merged

Embed: proxy buffers for the subscribe response headers #1548

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions apps/self-hosted/hosting/nginx-multi-tenant.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,6 +143,16 @@ server {
proxy_set_header CF-Connecting-IP $http_x_real_ip;
proxy_read_timeout 15s;
client_max_body_size 16k;
# The origin is Next, which attaches a ~3.5KB report-only CSP to every
# response, so even a 400 carries about 4.2KB of headers and overflows
# nginx's 4k default: the read fails with "upstream sent too big header"
# and the reader gets a 502 from their own signup form. eu.ecency.com
# carries the same buffers for the same reason. Location scope, because
# this is the only location here that proxies to the web tier; the rest
# go to hosting_api, whose headers are small.
proxy_buffer_size 16k;
proxy_buffers 8 16k;
proxy_busy_buffers_size 16k;
Comment on lines +153 to +155

@qodo-code-review qodo-code-review Bot Aug 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remediation recommended

1. Missing proxy buffer regression test 📘 Rule violation ▣ Testability

This bug fix changes the nginx response-header buffering path, but the change set adds no automated
regression test for an oversized upstream header producing a non-502 response. Manual verification
in the PR description does not satisfy the requirement for a test that fails before the fix and
passes after it.
Agent Prompt 
## Issue description
The new proxy buffer configuration fixes an oversized upstream response-header failure, but no automated regression test was added.

## Issue Context
The test must reproduce an upstream response with headers larger than nginx's default buffer and assert that the request is passed through rather than returned as 502.

## Fix Focus Areas
- apps/self-hosted/hosting/nginx-multi-tenant.conf[153-155]
- apps/self-hosted/hosting

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

}

location = /robots.txt {
Expand Down Expand Up @@ -252,6 +262,16 @@ server {
proxy_set_header CF-Connecting-IP $http_x_real_ip;
proxy_read_timeout 15s;
client_max_body_size 16k;
# The origin is Next, which attaches a ~3.5KB report-only CSP to every
# response, so even a 400 carries about 4.2KB of headers and overflows
# nginx's 4k default: the read fails with "upstream sent too big header"
# and the reader gets a 502 from their own signup form. eu.ecency.com
# carries the same buffers for the same reason. Location scope, because
# this is the only location here that proxies to the web tier; the rest
# go to hosting_api, whose headers are small.
proxy_buffer_size 16k;
proxy_buffers 8 16k;
proxy_busy_buffers_size 16k;
}

location = /robots.txt {
Expand Down
Loading