'proxy_set_header Host' causes https drop in proxied redirect's Location header

[Bagrat Lazaryan]

Consider the following configuration accessible at ​https://proxy

server {
    listen 80;
    listen 443 ssl;
    server_name proxy;
    ssl_certificate /etc/nginx/ssl/proxy.crt;
    ssl_certificate_key /etc/nginx/ssl/proxy.key;

    location / {
	    proxy_pass http://app;
	    proxy_pass_request_headers on;
	    proxy_set_header Host $http_host;
    }
}

Now consider this accessible at ​http://app from proxy:

server {
    listen       80;
    server_name  app;

    location / {
        return 200 "app";
        add_header Content-Type text/plain;
    }

    location /redirect {
	    return 302 /redirected;
    }

    location /redirected {
        return 200 "redirected";
        add_header Content-Type text/plain;
    }
}

Now, if we access ​https://proxy/redirect we are redirected to ​http://proxy/redirected. Note the https drop to http.
If we remove the 'proxy_set_header Host $http_host;' from proxy's configuration, we are then redirected correctly to ​https://proxy/redirected.

[Maxim Dounin]

This because ​proxy_redirect uses what is written in the proxy_pass directive by default, and hence it is able to detect that redirects to http://app/redirected needs to be rewritten to https://proxy/redirected. But does not know anything about arbitrary headers you can add using proxy_set_header, and as such redirects to http://proxy/redirected returned by the backend are passed to the client without modifications. To fix this, consider configuring proxy_redirect appropriately.

[Bagrat Lazaryan]

Understood. Thanks for explanation!