{"action":"created","issue":{"url":"https://api.github.com/repos/phusion/passenger/issues/1707","labels_url":"https://api.github.com/repos/phusion/passenger/issues/1707/labels{/name}","comments_url":"https://api.github.com/repos/phusion/passenger/issues/1707/comments","events_url":"https://api.github.com/repos/phusion/passenger/issues/1707/events","html_url":"https://github.com/phusion/passenger/issues/1707","id":122570559,"number":1707,"title":"Unable to access request environment variables with passenger 5.0.22","user":{"login":"hajimenomomo","id":8296549,"avatar_url":"https://avatars.githubusercontent.com/u/8296549?v=3","gravatar_id":"","url":"https://api.github.com/users/hajimenomomo","html_url":"https://github.com/hajimenomomo","followers_url":"https://api.github.com/users/hajimenomomo/followers","following_url":"https://api.github.com/users/hajimenomomo/following{/other_user}","gists_url":"https://api.github.com/users/hajimenomomo/gists{/gist_id}","starred_url":"https://api.github.com/users/hajimenomomo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hajimenomomo/subscriptions","organizations_url":"https://api.github.com/users/hajimenomomo/orgs","repos_url":"https://api.github.com/users/hajimenomomo/repos","events_url":"https://api.github.com/users/hajimenomomo/events{/privacy}","received_events_url":"https://api.github.com/users/hajimenomomo/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/phusion/passenger/labels/SupportCentral","name":"SupportCentral","color":"fef2c0"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-12-16T18:17:49Z","updated_at":"2015-12-17T11:50:26Z","closed_at":null,"body":"Hi,\r\nSince the latest version of passenger (5.0.22), accessing request specific environment variables from my Rails 4.2.4 (Ruby 2.2.3) doesn't work anymore. For instance the term request.env['HTTP_HOST'], just gives a nil field for every request, whereas request.host works flawlessly. This applies to every request specific field accessed through request.env['FOO'], and also to my authentication tokens for instance, this problem doesn't happen with previous versions of passenger 5.\r\nSincerely,"},"comment":{"url":"https://api.github.com/repos/phusion/passenger/issues/comments/165433437","html_url":"https://github.com/phusion/passenger/issues/1707#issuecomment-165433437","issue_url":"https://api.github.com/repos/phusion/passenger/issues/1707","id":165433437,"user":{"login":"OnixGH","id":10709325,"avatar_url":"https://avatars.githubusercontent.com/u/10709325?v=3","gravatar_id":"","url":"https://api.github.com/users/OnixGH","html_url":"https://github.com/OnixGH","followers_url":"https://api.github.com/users/OnixGH/followers","following_url":"https://api.github.com/users/OnixGH/following{/other_user}","gists_url":"https://api.github.com/users/OnixGH/gists{/gist_id}","starred_url":"https://api.github.com/users/OnixGH/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OnixGH/subscriptions","organizations_url":"https://api.github.com/users/OnixGH/orgs","repos_url":"https://api.github.com/users/OnixGH/repos","events_url":"https://api.github.com/users/OnixGH/events{/privacy}","received_events_url":"https://api.github.com/users/OnixGH/received_events","type":"User","site_admin":false},"created_at":"2015-12-17T11:50:26Z","updated_at":"2015-12-17T11:50:26Z","body":"@giorgian allowing headers with underscores, especially with authentication, leads to the header overwriting security vulnerability [CVE-2015-7519](https://blog.phusion.nl/2015/12/07/cve-2015-7519) as discovered by the SUSE security team.\r\n\r\nIn your case for example, a client set the header `Auth-Token` and it will potentially overwrite your `AUTH_TOKEN` header.\r\n\r\nSo while you can configure Nginx to allow underscored headers, the conclusion is still the same: when they reach Passenger they will be dropped to prevent CVE-2015-7519."}}