Header unset seems not to work with apache 2.4.10 and php-fpm

Solution 1:

mod_proxy_fcgi adds response headers to r->err_headers_out which means you should use at least:

Header unset X-Userid always

But there is no reason to not use both:

Header always unset X-Userid
Header unset X-Userid

This is an unfortunate part of the Apache API that bleeds into mod_headers -- headers can live in two places depending if they're meant to persist for non-success responses.

Solution 2:

From troubleshooting in the comments, I think this is a bug - the headers coming back from mod_proxy_fcgi seem to be unavailable to mod_headers in any way, and are being combined with the data from mod_headers after it processes.

For now, if you need this behavior to work correct, maybe look at nginx or lighttpd, or slapping an HAProxy or Varnish instance in front of Apache to do the logging and header manipulation in the right way?

Solution 3:

This question is old, but may help someone looking for its final solution:

As covener pointed out with Header unset you should also set the condition 'always' when setting the note:

Header always note X-Userid userid
Header always unset X-Userid

Use %{userid}n as placeholder for the variable (n from 'internal note' that is were mod_headers saves the value of the variable.

From the docs:

Header [condition] note header value

The optional condition argument determines which internal table 
of responses headers this directive will operate against. Despite the 
name, the default value of onsuccess does not limit an action to 
responses with a 2xx status code. Headers set under this condition are 
still used when, for example, a request is successfully proxied or 
generated by CGI, even when they have generated a failing status code.