NGINX config proxy_set_header Host $host prevents IP address from being set

strange

4/12/24, 9:53 AM

My NGINX server has following Server Block

upstream main {
  least_conn;
  #Add entries one per upstream server
  server web01:4000 max_fails=3 fail_timeout=5s;
  server web01:4001 max_fails=3 fail_timeout=5s;
}

server {  
  ssl_prefer_server_ciphers on;
  ssl_protocols TLSv1.2;
  ssl_ciphers EECDH+ECDSA+AESGCM;
  ssl_certificate  webserver.pem;
  ssl_certificate_key webserver.key;
  server_tokens off;
  listen              443 ssl;
  allow all;
  server_name         example.com;
  proxy_set_header x-real-ip $proxy_add_x_forwarded_for;
  proxy_set_header x-remote-ip $remote_addr;
  proxy_hide_header Server;
  proxy_hide_header x-powered-by;

  location /test_url {
    proxy_pass http://main;
    proxy_set_header Host $host;
    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
  }

  location    / {
    proxy_pass http://main;
    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
  }
}

The question is I want to get the exact hostname which was received at nginx. In this case example.com at the next hop for request URI /test_url. I am able to achieve that with proxy_set_header Host $host but then I do not see x-real-ip or x-remote-ip headers being set anymore. If I remove proxy_set_header Host $host settings, the IP headers are getting set. Does anyone have any idea, why this behaviour or what I should do to achieve both?

164

1 + 0

nginx

nginx-unit

nginx-ingress

nginx-reverse-proxy

Score:0

Server

boppy

4/12/24, 10:51 AM

Most directives of nginx' config file do overwrite the previously defined.

That means your config proxy_set_header (on server) IS NOT TAKEN into account INSIDE your location. You have to re-apply those rules like:

server {  
  ssl_prefer_server_ciphers on;
  ssl_protocols TLSv1.2;
  ssl_ciphers EECDH+ECDSA+AESGCM;
  ssl_certificate  webserver.pem;
  ssl_certificate_key webserver.key;
  server_tokens off;
  listen              443 ssl;
  allow all;
  server_name         example.com;
  proxy_set_header x-real-ip $proxy_add_x_forwarded_for;
  proxy_set_header x-remote-ip $remote_addr;
  proxy_hide_header Server;
  proxy_hide_header x-powered-by;

  location /test_url {
    proxy_pass http://main;
    proxy_set_header Host $host;
    proxy_set_header x-real-ip $proxy_add_x_forwarded_for;
    proxy_set_header x-remote-ip $remote_addr;    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
  }

  location    / {
    proxy_pass http://main;
    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
  }
}

+ 2

strange

4/13/24, 4:51 AM

Thanks @boppy, that clarifies. Strange they don't have this behaviour documented anywhere or may be I couldn't find any.

boppy

4/13/24, 7:34 AM

They do point it out in the docs under ["inheritance"](https://docs.nginx.com/nginx/admin-guide/basic-functionality/managing-configuration-files/#inheritance). But I agree it's not as clear as it could be... ;)

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: NGINX config proxy_set_header Host $host prevents IP address from being set

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.