Not able to use Nginx's error_page in conjunction with *_by_lua_block

[giorgiosironi]

I am using the following Nginx configuration:

worker_processes  1;  
error_log logs/error.log debug;
events {
    worker_connections 1024;
}
http {
    server {
        listen 8080;
        location / { 
            default_type text/html;
            content_by_lua '
                ngx.say("<p>hello, world</p>")
                ';  
        }   

        proxy_intercept_errors on; 
        recursive_error_pages on; 
        error_page 403 =403 /4xx.html;

        location /4xx.html {
            root /usr/local/openresty/nginx/html;
        }   

        location /forbidden_lua {
            content_by_lua_block {
                ngx.status = 403 
                ngx.say("Forbidden from a lua block")
                return ngx.exit(403)
            }   
        }   
    }   
}

with the version:

$ /usr/local/openresty/nginx/sbin/nginx -v
nginx version: openresty/1.11.2.1

From what I understood ngx.exit stop further Lua blocks from being evaluated and returns the result to Nginx. So I would expect Nginx's error_page to let me intercept the 403 being returned by Lua code, and show my 4xx.html file, but it doesn't:

$ curl -v http://localhost:8080/forbidden_lua
* Hostname was NOT found in DNS cache
*   Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 8080 (#0)
> GET /forbidden_lua HTTP/1.1
> User-Agent: curl/7.35.0
> Host: localhost:8080
> Accept: */*
> 
< HTTP/1.1 403 Forbidden
* Server openresty/1.11.2.1 is not blacklisted
< Server: openresty/1.11.2.1
< Date: Mon, 26 Sep 2016 13:35:38 GMT
< Content-Type: text/plain
< Transfer-Encoding: chunked
< Connection: keep-alive
< 
Forbidden from a lua block

[giorgiosironi]

https://groups.google.com/forum/#!searchin/openresty-en/error_page|sort:relevance/openresty-en/1XASYFeP61o/W93sexzXTNkJ seems similar, but I am not using any *_by_lua directives at the server level, only at the correct location level.

[agentzh]

@giorgiosironi Are you sure there exists a /usr/local/openresty/nginx/html/4xx.html file in your file system?

[giorgiosironi]

To be precise, I added that file; its content is just:

4xx custom response

$ ls -l /usr/local/openresty/nginx/html/
total 12
-rwxrwxrwx 1 root root  20 Sep 26 14:34 4xx.html
-rw-r--r-- 1 root root 541 Sep 26 14:24 50x.html
-rw-r--r-- 1 root root 558 Sep 26 14:24 index.html

[agentzh]

@giorgiosironi Try building your openresty temporarily with the --with-debug option and configure error_log logs/error.log debug in your nginx.conf. Let's see what's going on in nginx's debugging logs. This should work.

[giorgiosironi]

This is the log, after starting nginx and executing curl -v http://localhost:8080/forbidden_lua:
https://gist.github.com/anonymous/38bdceb7ecd8ae33531b8625db8c8d47

[agentzh]

@giorgiosironi Okay, I see what's going on here. To solve your problem, you should replace

        location /forbidden_lua {
            content_by_lua_block {
                ngx.status = 403 
                ngx.say("Forbidden from a lua block")
                return ngx.exit(403)
            }   
        }

with

        location /forbidden_lua {
            content_by_lua_block {
                return ngx.exit(403)
            }   
        }

The reason is that for error_page to work, you must not generate and send your own response via the ngx.status and ngx.say/ngx.print API. This is how error_page works.

[giorgiosironi]

Ok, got it. For the record, I was trying to setup an error_page to customize the errors coming from Kong: https://github.com/Mashape/kong/blob/master/kong/tools/responses.lua#L119

[sallespro]

@giorgiosironi did you find a workaround way to do it with Kong ?

[agentzh]

Hey, guys, you should really report it to Kong instead. Already off topic.