nginx-1.9.13: no longer retry non-idempotent upstream requests by default

Want to help support this blog? Try out Oh Dear, the best all-in-one monitoring tool for your entire website, co-founded by me (the guy that wrote this blogpost). Start with a 10-day trial, no strings attached.

We offer uptime monitoring, SSL checks, broken links checking, performance & cronjob monitoring, branded status pages & so much more. Try us out today!

Profile image of Mattias Geniar

Mattias Geniar, March 29, 2016

Follow me on Twitter as @mattiasgeniar

Release 1.9.13 of Nginx, just out a couple of hours ago, fixes a long standing bug: non-idempotent requests could be resent to another upstream, potentially causing multiple form submits, multiple deletes, …

In simpler terms: a POST request sent to Nginx could be sent to multiple upstreams if for some reason the connection to the initial upstream got closed. That upstream may very well have received that POST request and modified data as a result. But Nginx would resend that POST to a second upstream either way.

You can image the potential hard-to-debug error that come as a result of that.

Either way, Nginx 1.9.13 is available now and changes that default behaviour so it no longer repeats POST, LOCK or PATCH requests.

*) Change: non-idempotent requests (POST, LOCK, PATCH) are no longer

passed to the next server by default if a request has been sent to a

backend; the “non_idempotent” parameter of the “proxy_next_upstream”

directive explicitly allows retrying such requests.

[nginx-announce] nginx-1.9.13

It’s interesting that this took so long to implement.



Want to subscribe to the cron.weekly newsletter?

I write a weekly-ish newsletter on Linux, open source & webdevelopment called cron.weekly.

It features the latest news, guides & tutorials and new open source projects. You can sign up via email below.

No spam. Just some good, practical Linux & open source content.