Nginx add_header Duplicates Headers Instead of Overriding, Silently Breaking Security

A developer discovered a critical misconfiguration after deploying a baseline of security headers across nginx virtual hosts intended to protect apps that set none of their own. Within an hour, production responses showed duplicate and contradictory headers — for example, both X-Frame-Options: DENY from the app and SAMEORIGIN from the baseline appearing simultaneously. Browsers receiving conflicting directives for the same header treat it as absent entirely, meaning the stricter app-level setting was effectively nullified. The root cause was a misunderstanding of nginx's add_header directive, which always appends rather than replaces existing headers and cannot conditionally check upstream responses. The developer resolved the issue using nginx map directives on upstream header variables, since add_header offers no built-in conditional or override logic.