Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a redirect loop problem with a website that gets reversed proxied by nginx 1.2.1. It looks like the following is the cause (which I don't know how to solve)

Inspecting the site with httpfox, the request my browser sends looks like this:

https://www.acme.eu/acm/admin/gui_call.php?Object=admin@GuiAdminStartpage&Params[gui]=&action=&no_subtitle=1

My nginx log tells me this:

GET 1/acm/admin/gui_call.php?Object=admin@GuiAdminStartpage&params%252525252525252525252525255bgui%252525252525252525252525255d=&action=&no_subtitle=1 HTTP/1.1" HTTP/1.1" 301 486 "https://www.acme.eu/acm/ui/" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:13.0) Gecko/20100101 Firefox/13.0.1"

(This repeats over and over until firefox detects the loop)

To me it looks like somehow nginx changes the square brackets around "gui" into "252525252525252525252525255b" and "252525252525252525252525255d" respectively. I assume that because the script gui_call.php gets wrong parameters, it redirects to /acm/ui. /acm/ui calls gui_call.php with wrong paramters, and so on.

If my interpretation is correct, how can I stop this? If not, what is going on here?

My site specific config:

proxy_cache_path  /var/lib/nginx/proxy/cache/www.acme.eu levels=1:2 keys_zone=www.acme.eu-cache:8m max_size=2000m inactive=600m;
# http
server{
    server_name www.acme.eu;
    listen 80;
    access_log /var/log/nginx/access_www.acme.eu_80.log;
    error_log /var/log/nginx/error_www.acme.eu_80.log;
    proxy_cache www.acme.eu-cache;
    proxy_cache_valid  200 302  600m;
    proxy_cache_valid  404      10m;
    location  ~* \.(jpg|gif|png|css|js) {
            try_files $uri @proxy;
    }
    location @proxy {
            proxy_pass http://www.acme.eu;
    }
    location / {
            proxy_pass http://www.acme.eu;
    }       
}       
# https 
server{         
    server_name www.acme.eu;
    listen 443;
    ssl on; 
    ssl_certificate /etc/nginx/ssl/acme_eu.crt;
    ssl_certificate_key /etc/nginx/ssl/acme_eu.key;
    access_log /var/log/nginx/access_www.acme.eu_443.log;
    error_log /var/log/nginx/error_www.acme.eu_443.log;
    proxy_cache www.acme.eu-cache;
    proxy_cache_valid  200 302  600m;
    proxy_cache_valid  404      10m;
    location  ~* \.(jpg|gif|png|css|js) {
            try_files $uri @proxy;
    }
    location @proxy {
            proxy_pass http://www.acme.eu;
    }
    location / {
            proxy_pass http://www.acme.eu;
    }
}

General Config

user www-data;
worker_processes 16;
pid /var/run/nginx.pid;

events {
    worker_connections 768;
}

http {

    ##
    # Basic Settings
    ##

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ##
    # Logging Settings
    ##

    access_log /var/log/nginx/access.log;
    #error_log /var/log/nginx/error.log debug;
    error_log /var/log/nginx/error.log;

    ##
    # Gzip Settings
    ##

    gzip on;
    gzip_disable "msie6";

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
    index index.html index.htm ;

    ##
    # Proxy Settings
    ##
    proxy_temp_path /var/lib/nginx/proxy/tmp;
}

EDIT: It turned out the problem was that this one site forced ssl, so I needed to define a backend that uses ssl. Using ssl on the backend is not so usefull, but thats a different topic :)

share|improve this question
    
y u no post ur config! –  Pineapple Under the Sea Jul 13 '12 at 12:38
    
It sounds like gui_call.php is not performing URL decoding. –  mgorven Jul 13 '12 at 22:55
    
Unfortunatly, the code is not in my reach ... so I was thinking of excluding the whole admin thingy form being cached. I tried something like location ^~ /acme/admin { proxy_pass http://www.acme.eu; } with no success. Any hints on how I could achive this? –  Isaac Jul 16 '12 at 7:50
    
@Isaac: feel free to post it as an answer and accept it when you can. –  quanta Aug 31 '12 at 15:53
add comment

1 Answer

up vote 0 down vote accepted

It turns out the problem was that this one site forced ssl. So while the backend tried to redirect to ssl, nginx tried no ssl again and again, which caused the redirect loop.

The obvious solution would be to put the ssl frocing in nginx and disable it on the backend. But since we are still in testing and the backend is in production as a regular webserver, this is currently not an option.

What I did is I defined a backend that uses ssl. In my locations I have

    location  ~* \.(jpg|gif|png|css|js) {
            try_files $uri @proxy;
    }
    location @proxy {
            proxy_pass https://backend-secure-all-apaches;
    }
    location / {
            proxy_pass https://backend-secure-all-apaches;
    }
    proxy_set_header Host $host;

Note the proxy_set_header Host $host; which was important to get the ssl thingy right. Then I defined the backend as follows:

    upstream backend-secure-all-apaches {
            server 17.123.22.25:443;
            server 17.123.22.26:443;
            server 17.123.22.27:443;
   }
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.