Adding response headers (add_header) in Nginx - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

What is the output of this nginx configuration snippet?

Given this nginx server block snippet, what response header will be added to all responses?

Nginx

server {
    listen 80;
    server_name example.com;

    location / {
        add_header X-Custom-Header "HelloWorld";
        return 200 'OK';
    }
}

A No X-Custom-Header added to response

B Response includes header: X-Custom-Header: "HelloWorld" (with quotes)

C Response includes header: X-Custom-Header: HelloWorld with status 404

D Response includes header: X-Custom-Header: HelloWorld

💡 Hint

Remember that add_header adds headers without quotes in the value.

The add_header directive adds the header with the exact string value without quotes. The return 200 sends status 200 with the body 'OK'.

❓ Troubleshoot

intermediate

Why is the custom header not appearing on 404 responses?

You added add_header X-Test "TestValue"; inside the location block, but the header does not appear on 404 error pages. Why?

A add_header only adds headers on successful (2xx) responses by default

B The header name is invalid and ignored by nginx

C You must restart nginx for add_header to work

D add_header works only in http block, not location

💡 Hint

Check nginx documentation about add_header behavior on error responses.

By default, add_header adds headers only on 2xx and 3xx responses. To add headers on 4xx or 5xx, you must use 'add_header ... always;' directive.

❓ Configuration

advanced

Which configuration correctly adds a security header on all responses including errors?

Select the nginx configuration snippet that adds the header 'X-Security: Enabled' on every response, including 404 and 500 errors.

A add_header X-Security "Enabled" always;

B add_header X-Security "Enabled";

C add_header always X-Security "Enabled";

D add_header X-Security Enabled always;

💡 Hint

The 'always' parameter must come after the header value.

The correct syntax is 'add_header always;'. Option A uses this syntax correctly.

🔀 Workflow

advanced

Order of add_header directives in nested blocks

Given this nginx config, which headers will be present in the response for a request to /api/data? http { add_header X-Global "global"; server { listen 80; add_header X-Server "server"; location /api/ { add_header X-API "api"; location /api/data { add_header X-Data "data"; return 200 'OK'; } } } }

A X-API, X-Data

B Only X-Data

C X-Global, X-Server, X-API, X-Data

D X-Global, X-Server, X-Data

💡 Hint

Headers from outer blocks are inherited unless overridden.

add_header directives are additive in nested blocks. All headers from http, server, and location blocks apply unless overridden.

✅ Best Practice

expert

What is the recommended way to add security headers globally in nginx?

You want to add security headers like Content-Security-Policy and X-Frame-Options to all responses on your nginx server, including error pages. What is the best practice?

A Add add_header directives without 'always' inside each server block

B Add add_header directives with 'always' parameter inside the http block

C Add add_header directives inside location blocks only for main routes

D Use add_header directives only in error_page blocks

💡 Hint

Think about coverage and maintainability for all responses.

Adding headers with 'always' in the http block ensures all responses, including errors, have the headers globally without repetition.