nginx sends duplicate header

Question

In my nginx.conf file I define a header on the http level

add_header Strict-Transport-Security "max-age=86400; includeSubDomains" always;

When I check the network response headers in chrome dev tools, it shows 2 of those headers

strict-transport-security: max-age=15552000; includeSubDomains
strict-transport-security: max-age=86400; includeSubDomains

Notes:

• In my config file I only use add_header once.
• I also have no include directive
• I cannot find another nginx.conf file in the nginx-docker image

Questions:

• Any idea where the 2nd header can come from?
  i.e. some default or some inheritance from another config file)
• Maybe any idea how I could debug this?

Answer 1

thanks @RichardSmith for the great comment.

• nginx -T is really great for testing, as it will show the full configuration (with all includes, etc.)
• curl -I also showed both headers (to make sure that the browser does not used any cache, etc.)
• in deed the 2nd header was sent from the upstream server - and then nginx added the one I defined in the nginx.conf