In that case, please add an option to turn this off. This plays havoc with systems that are setting that header elsewhere (such as on a reverse proxy to php-fpm) because you get conflicting headers, which leads to unexpected behavior.

The much better approach would be to allow the administrator to configure the age. If they wanted to overwrite older settings, they could turn on the header and set max-age to 0 on their own. Blindly sending it when the option that claims to control whether it's sent is set to false is misleading and problematic.

I *could* overwrite the header, if I knew it was being set in the first place.

The current behavior does *not* match what's documented.

@jefferai how did you overwrite the headers? I'm encountering this exact same issue.

For reference, even though this isn't right. I figured I'd put my notes here for someone else to find and help me out:

location / {
    client_max_body_size 32M;
    proxy_set_header        Host $host;
    proxy_set_header        X-Real-IP $remote_addr;
    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header        X-Forwarded-Proto $scheme;
    proxy_set_header        X-Frame-Options DENY;
    proxy_set_header        X-XSS-Protection "1; mode=block";
    proxy_set_header        Referrer-Policy no-referrer-when-downgrade;

    proxy_redirect		    off;
    proxy_pass http://127.0.0.1:8080;
}