From 30f0ddd91273adb81268de78d060bfaee6ce6bb6 Mon Sep 17 00:00:00 2001 From: Matthew Holt Date: Thu, 18 Jun 2026 09:34:04 -0600 Subject: [PATCH] caddyhttp: Document dropping underscore headers --- modules/caddyhttp/app.go | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/modules/caddyhttp/app.go b/modules/caddyhttp/app.go index b72270e84..d9d9b9f84 100644 --- a/modules/caddyhttp/app.go +++ b/modules/caddyhttp/app.go @@ -46,6 +46,13 @@ func init() { // only on the HTTPS port but which do not have any TLS connection policies // defined by adding a good, default TLS connection policy. // +// Similar to how other popular web servers work, incoming request header fields +// with underscores are ignored/dropped implicitly to mitigate security risks. +// Specific headers to allow can be explicitly configured using +// `expected_underscore_headers`. +// +// ### Placeholders +// // In HTTP routes, additional placeholders are available (replace any `*`): // // Placeholder | Description