Score:0

Proxy Redirect on NGINX not working as expected

cn flag

I set up nginx as a reverse proxy for two proxied servers. Each of them (proxy and proxied servers) is running as a container in a docker environment. Proxied server appalpha is simply an nginx:alpine serving a static webpage (just for demo and testing purposes). All works fine here because things are simple. The other proxied server's image is kanboard/kanboard. When I try to access this service through my reverse proxy at https://example.com/kanboard/ I first get an expected http response with status code 302 (Found). But the header is set to Location: /login (i.e pointing to my reverse proxy) which does not exist. My expectation is to see a header field of Location: /kanboard/login here.

I tried with several proposed configurations without success:

  • without proxy_redirect
  • with proxy_redirect
  • with rewrite (which is not the right concept here, as far as I understand)
  • with return (which is not the right concept here neither, right?!)

What am I doing wrong?

My proxy.conf of the nginx reverse proxy lists as follows:

server {
    listen                    443 ssl http2;
    server_name               example.com;
    server_tokens             off;
    ssl_certificate           /etc/nginx/ssl/example.com.crt;
    ssl_certificate_key       /etc/nginx/ssl/example.com.key;
    ssl_session_cache         builtin:1000  shared:SSL:10m;
    ssl_protocols             TLSv1.3;
    ssl_ciphers               "HIGH !aNULL !eNULL !EXPORT !CAMELLIA !DES !MD5 !PSK !RC4";
    ssl_prefer_server_ciphers on;
    access_log                /var/log/nginx/nginx-2443.log;
    proxy_cache_valid         any 1s;

    location /alpha {
        proxy_set_header      Host $host;
        proxy_set_header      X-Real-IP $remote_addr;
        proxy_set_header      X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header      X-Forwarded-Proto $scheme;
        proxy_pass            http://appalpha/;
    }

    location /eval_kanboard {
        proxy_set_header      Host $host;
        proxy_set_header      X-Real-IP $remote_addr;
        proxy_set_header      X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header      X-Forwarded-Proto $scheme;
        proxy_pass            https://restore_eval_kanboard/;
    }
}

I appreciate your help.

Cheers Thomas

us flag
The redirect URL is generated by your application, so you need to look how to specify the base URL for `kanboard`.
tab269 avatar
cn flag
Thanks for your suggested fix. I set the base URL in the application `kanboard` to `https://example.com/kanboard/`. Unfortunately getting the same `302 (Found)` response with `Location: /login`. Isn't this one of the main features of a reverse proxy to be able to redirect/rewrite requests as well as responses?! And should the proxied server care in which environment it is running?! From the proxied server perspective, the _relative_ `Location: /login` _is_ correct, because it does not know about the reverse proxy. But the reverse proxy should be able to redirect/rewrite to `/kanboard/login`.
us flag
Such a rewrite cannot be implemented reliably in reverse proxy context. Reverse proxy only sees text stream, it doesn't have any idea of its organisation. The URLs can be in many formts in the text stream. Doing simple search & replace over the text stream can cause all kinds of bad side-effects. Therefore it has to be set up in the application.
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.