Opened 3 years ago

Closed 3 years ago

#2323 closed defect (duplicate)

URI rewrite does not work when limit_except is defined in same context

Reported by: Napsty@… Owned by:
Priority: major Milestone:
Component: nginx-core Version: 1.18.x
Keywords: rewrite limit_except Cc:
uname -a: Linux server 5.4.0-66-generic #74-Ubuntu SMP Wed Jan 27 22:54:38 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
nginx -V: nginx version: nginx/1.18.0 (Ubuntu)
built with OpenSSL 1.1.1f 31 Mar 2020
TLS SNI support enabled
configure arguments: --with-cc-opt='-g -O2 -fdebug-prefix-map=/build/nginx-5J5hor/nginx-1.18.0=. -fstack-protector-strong -Wformat -Werror=format-security -fPIC -Wdate-time -D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now -fPIC' --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --modules-path=/usr/lib/nginx/modules --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-debug --with-compat --with-pcre-jit --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_v2_module --with-http_dav_module --with-http_slice_module --with-threads --with-http_addition_module --with-http_flv_module --with-http_geoip_module=dynamic --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module=dynamic --with-http_mp4_module --with-http_perl_module=dynamic --with-http_random_index_module --with-http_secure_link_module --with-http_sub_module --with-http_xslt_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-stream=dynamic --with-stream_ssl_module --with-stream_ssl_preread_module --add-dynamic-module=/build/nginx-5J5hor/nginx-1.18.0/debian/modules/http-headers-more-filter --add-dynamic-module=/build/nginx-5J5hor/nginx-1.18.0/debian/modules/http-auth-pam --add-dynamic-module=/build/nginx-5J5hor/nginx-1.18.0/debian/modules/http-cache-purge --add-dynamic-module=/build/nginx-5J5hor/nginx-1.18.0/debian/modules/http-dav-ext --add-dynamic-module=/build/nginx-5J5hor/nginx-1.18.0/debian/modules/http-ndk --add-dynamic-module=/build/nginx-5J5hor/nginx-1.18.0/debian/modules/http-echo --add-dynamic-module=/build/nginx-5J5hor/nginx-1.18.0/debian/modules/http-fancyindex --add-dynamic-module=/build/nginx-5J5hor/nginx-1.18.0/debian/modules/nchan --add-dynamic-module=/build/nginx-5J5hor/nginx-1.18.0/debian/modules/http-lua --add-dynamic-module=/build/nginx-5J5hor/nginx-1.18.0/debian/modules/rtmp --add-dynamic-module=/build/nginx-5J5hor/nginx-1.18.0/debian/modules/http-uploadprogress --add-dynamic-module=/build/nginx-5J5hor/nginx-1.18.0/debian/modules/http-upstream-fair --add-dynamic-module=/build/nginx-5J5hor/nginx-1.18.0/debian/modules/http-subs-filter --add-dynamic-module=/build/nginx-5J5hor/nginx-1.18.0/debian/modules/http-geoip2

Description

Hello,

I am not certain whether this is a bug or if this is something which needs to be added to documentation.

Following situation:

  location ~\.rss$ {
    # Only allow OPTIONS, all other methods require basic auth
    limit_except OPTIONS {
      auth_basic "Auth";
      auth_basic_user_file /etc/nginx/auth/rss.auth;
    }

    rewrite ^/(.*) /v1/page/rss/my/$1 break;
    proxy_pass https://127.0.0.1:8080;

    add_header Requested-URI $request_uri always;
    add_header Final-URI $uri always;
  }

This should rewrite the requested URI from /last.rss to /v1/page/rss/my/last.rss. The additional headers (add_header) would show this. However the rewrite does not work. A HTTP request on /last.rss resuls in the following response:

requested-uri: /last.rss
final-uri: /last.rss

As soon as I remove the limit_except block, the rewrite works as expected:

  location ~\.rss$ {
    auth_basic "Auth";
    auth_basic_user_file /etc/nginx/auth/rss.auth;

    rewrite ^/(.*) /v1/page/rss/my/$1 break;
    proxy_pass https://127.0.0.1:8080;

    add_header Requested-URI $request_uri always;
    add_header Final-URI $uri always;
  }

Here the URI is correctly rewritten and can be confirmed in the response:

requested-uri: /last.rss
final-uri: /v1/page/rss/my/last.rss

Debug logs with limit_except in config:

2022/02/18 14:50:35 [debug] 1598545#1598545: *54 using configuration "\.rss$"
2022/02/18 14:50:35 [debug] 1598545#1598545: *54 http cl:-1 max:1048576
2022/02/18 14:50:35 [debug] 1598545#1598545: *54 rewrite phase: 3
2022/02/18 14:50:35 [debug] 1598545#1598545: *54 rewrite phase: 4
2022/02/18 14:50:35 [debug] 1598545#1598545: *54 post rewrite phase: 5

Debug logs without limit_except:

2022/02/18 14:49:24 [debug] 1597146#1597146: *223 using configuration "\.rss$"
2022/02/18 14:49:24 [debug] 1597146#1597146: *223 http cl:-1 max:1048576
2022/02/18 14:49:24 [debug] 1597146#1597146: *223 rewrite phase: 3
2022/02/18 14:49:24 [debug] 1597146#1597146: *223 rewrite phase: 4
2022/02/18 14:49:24 [debug] 1597146#1597146: *223 http script regex: "^/(.*)"
2022/02/18 14:49:24 [notice] 1597146#1597146: *223 "^/(.*)" matches "/last.rss", client: 127.0.0.1, server: www.example.com, request: "HEAD /last.rss HTTP/2.0", host: "www.example.com"
2022/02/18 14:49:24 [debug] 1597146#1597146: *223 http script copy: "/v1/page/rss/my/"
2022/02/18 14:49:24 [debug] 1597146#1597146: *223 http script capture: "last.rss"
2022/02/18 14:49:24 [debug] 1597146#1597146: *223 http script regex end
2022/02/18 14:49:24 [notice] 1597146#1597146: *223 rewritten data: "/v1/page/rss/my/last.rss", args: "", client: 127.0.0.1, server: www.example.com, request: "HEAD /last.rss HTTP/2.0", host: "www.example.com"
2022/02/18 14:49:24 [debug] 1597146#1597146: *223 post rewrite phase: 5

So is this a bug?
Or is this related to the documentation question in https://trac.nginx.org/nginx/ticket/2310, where Maxim Dounin answered:

"all nginx configuration directives are inherited from the previous levels (unless redefined at the current level). There are very few exceptions, notably [...] Block-level directives which introduce additional configuration contexts: notably [...] limit_except [...]"

Thanks!

Change History (1)

comment:1 by Maxim Dounin, 3 years ago

Resolution: → duplicate
Status: new → closed

Duplicate of #1383.

Note: See TracTickets for help on using tickets.