Nginx dynamic proxy_pass keeps redirecting to wrong domain

[Francis Daly]

On Fri, Nov 17, 2017 at 02:16:41PM +0100, Ruben wrote:

Hi there,

> instance-001 log when making the request:
> 
> "GET /cdn/test/test.jpg HTTP/1.0" 301 185 "-" "Mozilla/5.0 (Windows NT
> 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
> Chrome/62.0.3202.94 Safari/537.36"

Ok, that's good to know.

The client asks nginx for /cdn/test/test.jpg (with a Host: header
of example.com); nginx asks upstream for /cdn/test/test.jpg (with a
Host: header that we have not yet confirmed); upstream says to ask for
/cdn/test/test.jpg with a Host: header of instance-001.

One possibility is to change the web server on instance-001 to serve the
content to all requests, no matter what Host: header they use. That is
a bit unfriendly to instance-001.

Another possibility is to make sure than nginx sends a Host: header
of instance-001 when it make a request of instance-001. That should need
no changes to instance-001.

You could check fuller logs, or tcpdump the traffic, to see what Host:
header nginx currently sends to instance-001. But if you don't really
care, you can just configure nginx to send what you want.

(Yet another possibility is to change the web server on instance-001
to serve the instance-001 content whenever it gets the Host: header
that nginx currently sends. That only works if you know what nginx
currently sends.)

The second choice above is the one that is within nginx's control. So
(assuming that you have no proxy_set_header values already configured
at server{} or http{} level), in the same place where you currently have

  proxy_pass http://$instance;

add

  proxy_set_header Host $instance;

and see what changes.

If it doesn't all Just Work, then you may need to see what exactly nginx
is sending; but hopefully it won't come to that.

Note: I think that this should not be necessary; since I think that
nginx should probably already be setting the Host header to the value
of $instance. But obviously something is going wrong, so I think that
it is worth being explicit.

Good luck with it,

	f
-- 
Francis Daly        francis at daoine.org