proxy_redirect is missing feature for HTTP header "Link"

[jochenwezel@…]

PLEASE NOTE: please ignore space chars in urls in following ticket (I had to "remove" all external links to be able to post this ticket, here: "Maximum number of external links per post exceeded")

Used configuration

Given is a reverse proxy configuration like

location / {
    proxy_pass     https :// upstream/;
    proxy_redirect https :// upstream/ /;
}

As the documentation at https :// nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_redirect explains, proxy_redirect will change Location headers redirect. This is required and good and works.

HTTP Response of upstream server

My wordpress 6 system now starts to send HTTP responses like:

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 29 Mar 2023 15:31:02 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Link: <https :// upstream/index.php/wp-json/>; rel="https://api.w.org/"
Link: <https :// upstream/index.php/wp-json/wp/v2/pages/69>; rel="alternate"; type="application/json"
Link: <https :// upstream/>; rel=shortlink
Vary: Accept-Encoding
Content-Encoding: gzip

HTTP protocol standard

Since I've never seen this type of 'link' header before, this was a real surprise to me. But it seems that it's a feature which exists for many years, now: https :// www.w3.org/wiki/LinkHeader

Problem description

The problem is, that the many Link headers remain unchanged and are delivered (as they are) to the client. Of course, the client machine doesn't know anything about my upstream server and can't access it to load these linked urls.

The result is, that my nginx reverse proxy response to the client contains unchanged Link headers

Link: <https :// upstream/index.php/wp-json/>; rel="https://api.w.org/"
Link: <https :// upstream/index.php/wp-json/wp/v2/pages/69>; rel="alternate"; type="application/json"
Link: <https :// upstream/>; rel=shortlink

Feature request

So, proxy_redirect should (by default) substitute in headers

• Location
• Link [array]

Optionally, the substitution of Link headers could be configured with another switch (e.g. proxy_redirect_links) to on|off|default

[Maxim Dounin]

Note that there are a lot of ways how backend servers can sent various links to the client, including response headers and the response body. In general it is not possible to change all the links, and nginx only tries to support the most common use cases - such as the Location header (​proxy_redirect) and Set-Cookie headers (​proxy_cookie_domain, ​proxy_cookie_path, ​proxy_cookie_flags). Instead of using nginx to rewrite links, a better approach is to configure your backend server to send the correct links.

If configuring your backend server to return correct links is not an option, an immediately available solution for the Link header might be to use the ​proxy_hide_header directive to hide such incorrect links.

Alternatively, headers can be removed with proxy_hide_header and re-added with modifications by something like this (assuming up to 3 Link headers):

map $upstream_http_link $rewritten1_link {
    ~^(.*)https://upstream/(.*)$ $1https://example.org/$2;
    default $upstream_http_link;
}

map $rewritten1_link $rewritten2_link {
    ~^(.*)https://upstream/(.*)$ $1https://example.org/$2;
    default $rewritten1_link;
}

map $rewritten2_link $rewritten_link {
    ~^(.*)https://upstream/(.*)$ $1https://example.org/$2;
    default $rewritten2_link;
}

proxy_hide_header Link;
add_header Link $rewritten_link;

Note that this requires at least nginx 1.23.0 to properly handle multiple Link headers.

Having said that, it might still make sense to support easy rewriting of the Link headers, so keeping this feature request open for now.