Content-Type set incorrectly in lua-nginx-module

lua-nginx-module sets a default content-type and does not override it from lua script, but nginx can using the conf. Details follow:

• Version: openresty-1.11.2.2 on Ubuntu 16.04 on EC2
• Scenario:

1. I have set up a nginx + lua for 3scale for API application management. I meter the payload sizes in the HTTP requests and responses and deny access when they cross a certain threshold. The reporting to 3scale occurs using the nginx.location.capture function. Reporting to 3scale is always a POST operation, and they expect an application/x-www-form-urlencoded Content-Type, or none, which defaults to urlencoded. Anything other than these two are rejected by 3scale.

2. When I get a GET request for my backend (without a Content-Type header), the content-type is not set in nginx.location.capture and 3scale can easily accept requests by defaulting it to urlencoded payload, and everything works.

3. When I get a POST request for my backend (with a Content-Type of application/json), 3scale starts rejecting the reporting call. This is absurd as it's the same code that gets executed in both the cases.

4. tshark showed that the content-type set for reporting is derived from the original request, which is of type application/json.

5. Overriding the original request with ngx.req.set_header("Content-Type", "application/x-www-form-urlencoded") in the lua script had no effect.

6. Solved it by adding a proxy_set_header Content-Type "application/x-www-form-urlencoded";

7. Issue being that we cannot enforce a content type using the lua script while using nginx.location.capture.

• Snippet:

ngx.req.set_header("Content-Type", "application/x-www-form-urlencoded")
 
local res1 = ngx.location.capture("/report", {method = ngx.HTTP_POST, body = ngx.encode_args(report), share_all_vars = true })

Start with the ngx.req.set_header and ngx.location.capture behavior shown in the snippet, then compare it with the proxy_set_header workaround. Reproduce the reported GET and POST cases using openresty-1.11.2.2; done means the capture request honors the Lua-set application/x-www-form-urlencoded Content-Type without requiring proxy configuration.