(tooling-gofannon) branch main updated: nginx: preserve upstream X-Forwarded-Proto for OAuth redirect URI

[ak...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

andrewmusselman pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-gofannon.git


The following commit(s) were added to refs/heads/main by this push:
     new f9b0561  nginx: preserve upstream X-Forwarded-Proto for OAuth redirect URI
f9b0561 is described below

commit f9b056101b72ef97cb1ef9e1aa39926a558fa356
Author: Andrew Musselman <ak...@apache.org>
AuthorDate: Fri May 15 08:40:54 2026 -0700

    nginx: preserve upstream X-Forwarded-Proto for OAuth redirect URI
    
    When the webui container is fronted by Apache (production setup),
    Apache terminates TLS and sets X-Forwarded-Proto: https before
    proxying to nginx on http. The previous $scheme directive overwrote
    that with 'http' (the apache->nginx connection scheme), so uvicorn
    saw request.base_url as 'http://...'. The auth flow then built
    redirect_uri as 'http://...', which oauth.apache.org rejects with
    'Invalid redirect URI ... MUST be https'.
    
    Pass through the upstream's X-Forwarded-Proto value so the original
    scheme survives the apache->nginx->uvicorn chain.
---
 webapp/infra/docker/nginx.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/webapp/infra/docker/nginx.conf b/webapp/infra/docker/nginx.conf
index c474a76..2de30f5 100644
--- a/webapp/infra/docker/nginx.conf
+++ b/webapp/infra/docker/nginx.conf
@@ -17,7 +17,7 @@ server {
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
         proxy_set_header X-Forwarded-Host $host;
         proxy_read_timeout 600s;
         proxy_send_timeout 600s;


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org