Join Log in
Score:0
roy avatar Server

Nginx rewrite path

cl flag
roy

I want to rewrite /flask/files/ path to /utility/base-cert/flask/files/. So I tried following

        location /utility/base-cert/ {
            proxy_pass http://base-cert/;
        }

        location /flask/files/ {
            rewrite ^/flask/files/(.*)$ /utility/base-cert/flask/files/$1 permanent;
        }

base-cert app (http://base-cert/) is just to serve some downloadable files.

But it is working only for txt files, but not for other files. In the logs I see

10.2.19.165 - - [11/Feb/2022:21:40:52 +0000] "GET /utility/base-cert/flask/files/readme.md HTTP/1.1" 304 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36" "x.x.x.x"
10.2.19.165 - - [11/Feb/2022:21:40:58 +0000] "GET /utility/base-cert/flask/files/base.crt HTTP/1.1" 304 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36" "x.x.x.x"

In the browser I see following error

Mixed Content: The site at 'https://dev.example.com/' was loaded over a secure connection, but the file at 'https://dev.example.com/utility/base-cert/flask/files/base.crt' was redirected through an insecure connection. This file should be served over HTTPS. This download has been blocked. See https://blog.chromium.org/2020/02/protecting-users-from-insecure.html for more details.

Nginx Output

root@nginx-64fbcf4c54-2dkq7:/# nginx -T
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
# configuration file /etc/nginx/nginx.conf:

user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    include /etc/nginx/conf.d/*.conf;
}

# configuration file /etc/nginx/mime.types:

types {
    text/html                                        html htm shtml;
    text/css                                         css;
    text/xml                                         xml;
    image/gif                                        gif;
    image/jpeg                                       jpeg jpg;
    application/javascript                           js;
    application/atom+xml                             atom;
    application/rss+xml                              rss;

    text/mathml                                      mml;
    text/plain                                       txt;
    text/vnd.sun.j2me.app-descriptor                 jad;
    text/vnd.wap.wml                                 wml;
    text/x-component                                 htc;

    image/avif                                       avif;
    image/png                                        png;
    image/svg+xml                                    svg svgz;
    image/tiff                                       tif tiff;
    image/vnd.wap.wbmp                               wbmp;
    image/webp                                       webp;
    image/x-icon                                     ico;
    image/x-jng                                      jng;
    image/x-ms-bmp                                   bmp;

    font/woff                                        woff;
    font/woff2                                       woff2;

    application/java-archive                         jar war ear;
    application/json                                 json;
    application/mac-binhex40                         hqx;
    application/msword                               doc;
    application/pdf                                  pdf;
    application/postscript                           ps eps ai;
    application/rtf                                  rtf;
    application/vnd.apple.mpegurl                    m3u8;
    application/vnd.google-earth.kml+xml             kml;
    application/vnd.google-earth.kmz                 kmz;
    application/vnd.ms-excel                         xls;
    application/vnd.ms-fontobject                    eot;
    application/vnd.ms-powerpoint                    ppt;
    application/vnd.oasis.opendocument.graphics      odg;
    application/vnd.oasis.opendocument.presentation  odp;
    application/vnd.oasis.opendocument.spreadsheet   ods;
    application/vnd.oasis.opendocument.text          odt;
    application/vnd.openxmlformats-officedocument.presentationml.presentation
                                                     pptx;
    application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
                                                     xlsx;
    application/vnd.openxmlformats-officedocument.wordprocessingml.document
                                                     docx;
    application/vnd.wap.wmlc                         wmlc;
    application/wasm                                 wasm;
    application/x-7z-compressed                      7z;
    application/x-cocoa                              cco;
    application/x-java-archive-diff                  jardiff;
    application/x-java-jnlp-file                     jnlp;
    application/x-makeself                           run;
    application/x-perl                               pl pm;
    application/x-pilot                              prc pdb;
    application/x-rar-compressed                     rar;
    application/x-redhat-package-manager             rpm;
    application/x-sea                                sea;
    application/x-shockwave-flash                    swf;
    application/x-stuffit                            sit;
    application/x-tcl                                tcl tk;
    application/x-x509-ca-cert                       der pem crt;
    application/x-xpinstall                          xpi;
    application/xhtml+xml                            xhtml;
    application/xspf+xml                             xspf;
    application/zip                                  zip;

    application/octet-stream                         bin exe dll;
    application/octet-stream                         deb;
    application/octet-stream                         dmg;
    application/octet-stream                         iso img;
    application/octet-stream                         msi msp msm;

    audio/midi                                       mid midi kar;
    audio/mpeg                                       mp3;
    audio/ogg                                        ogg;
    audio/x-m4a                                      m4a;
    audio/x-realaudio                                ra;

    video/3gpp                                       3gpp 3gp;
    video/mp2t                                       ts;
    video/mp4                                        mp4;
    video/mpeg                                       mpeg mpg;
    video/quicktime                                  mov;
    video/webm                                       webm;
    video/x-flv                                      flv;
    video/x-m4v                                      m4v;
    video/x-mng                                      mng;
    video/x-ms-asf                                   asx asf;
    video/x-ms-wmv                                   wmv;
    video/x-msvideo                                  avi;
}

# configuration file /etc/nginx/conf.d/frontend.dev.lightcl.conf:
limit_req_zone $binary_remote_addr zone=login:10m rate=25r/s;

upstream uwsgi {
    server uwsgi:9000;
}

upstream base-cert {
    server base-cert:5000;
}

server {
    listen         80 default_server;
    server_name    localhost;
    keepalive_timeout 70;
    gzip on;
    gzip_disable "msie6";
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_types text/plain text/css application/json application/x-javascript application/javascript text/xml application/xml application/xml+rss text/javascript;

    location / {
         proxy_pass http://frontend-dev.s3-website-us-west-2.amazonaws.com/beta/;
         expires 30d;
    }

    location /api/ {
        uwsgi_pass uwsgi://uwsgi;
        include uwsgi_params;
    }

    location /utility/base-cert/ {
        proxy_pass http://base-cert/;
    }

    location /flask/files/ {
        rewrite ^/flask/files/(.*)$ /utility/base-cert/flask/files/$1 permanent;
    }

    location /metrics {
        stub_status;
    }

    location /stub_status {
        stub_status;
    }

    location /socket.io/ {
        proxy_pass http://websockets;
        proxy_redirect off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

server {
    listen 443 ssl;
    server_name localhost;
    keepalive_timeout 70;

    ssl_certificate     /etc/ssl/cert.pem;
    ssl_certificate_key /etc/ssl/key.pem;
    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    gzip on;
    gzip_disable "msie6";
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_types text/plain text/css application/json application/x-javascript application/javascript text/xml application/xml application/xml+rss text/javascript;

    location /vpn/ {
        uwsgi_pass uwsgi://uwsgi;
        include uwsgi_params;
    }
}

# configuration file /etc/nginx/uwsgi_params:

uwsgi_param  QUERY_STRING       $query_string;
uwsgi_param  REQUEST_METHOD     $request_method;
uwsgi_param  CONTENT_TYPE       $content_type;
uwsgi_param  CONTENT_LENGTH     $content_length;

uwsgi_param  REQUEST_URI        $request_uri;
uwsgi_param  PATH_INFO          $document_uri;
uwsgi_param  DOCUMENT_ROOT      $document_root;
uwsgi_param  SERVER_PROTOCOL    $server_protocol;
uwsgi_param  REQUEST_SCHEME     $scheme;
uwsgi_param  HTTPS              $https if_not_empty;

uwsgi_param  REMOTE_ADDR        $remote_addr;
uwsgi_param  REMOTE_PORT        $remote_port;
uwsgi_param  SERVER_PORT        $server_port;
uwsgi_param  SERVER_NAME        $server_name;

What would be the correct rewrite ?

78
0 + 0
us flag
Tero Kilkanen
Please add output of `nginx -T` so we can look at the full nginx configuration.
0
Reply
roy avatar
cl flag
roy
added output of `nginx -T`
0
Reply
us flag
Tero Kilkanen
Where is `dev.example.com` handled in the nginx configuration?
0
Reply
roy avatar
cl flag
roy
It goes to `proxy_pass http://frontend-dev.s3-website-us-west-2.amazonaws.com/beta/;`
0
Reply
us flag
Tero Kilkanen
It cannot go to that block, since `https://dev.example.com` is an SSL URL, and the `server` block for port 443 does not have any such `proxy_pass` directive.
0
Reply
roy avatar
cl flag
roy
SSL termination is handled by Traefik.
0
Reply
Score:0
avatar Server
us flag
Tero Kilkanen

You need to issue the redirect with https URL:

location /flask/files/ {
    rewrite ^/flask/files/(.*)$ https://$host/utility/base-cert/flask/files/$1 permanent;
}

Chrome is telling that the redirect destination of the URL has http as the protocol, therefore it is an insecure connection.

0 + 0
roy avatar
cl flag
roy
with this files are not getting downloaded after clicking on it.
0
Reply
us flag
Tero Kilkanen
What is the expected result?
0
Reply
roy avatar
cl flag
roy
I want files to download when i click on it
0
Reply
us flag
Tero Kilkanen
Ah sorry, misread. What is happening when you click it?
0
Reply
roy avatar
cl flag
roy
Only readme file opens in the browser, for other file nothing happens i was expecting other files to start downloading.
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.