0

We are proxying requests to a AWS cloudfront server in NGINX like this:

location /assets/ {
    proxy_set_header        X-Real-IP       $remote_addr;
    proxy_set_header        X-Forwarded-For $remote_addr;
    proxy_set_header        Host    upstream.example.com;
    proxy_pass      https://upstream.example.com/assets/;
    proxy_set_header        Authorization "Basic Zm9vOmJhcg==";
    proxy_ssl_server_name on;
}

As you can see, the cloudfront site needs a basic auth authorization. We notices, that this caches the DNS entries of upstream.example.com and changed use now variables which cause a re-resolve. The re-resolve works fine.

resolver 8.8.8.8 ipv6=off;

location /assets/ {
    set $backend_website upstream.example.com;
    proxy_set_header        X-Real-IP       $remote_addr;
    proxy_set_header        X-Forwarded-For $remote_addr;
    proxy_set_header        Host    upstream.example.com;
    proxy_pass      https://$backend_website/assets/;
    proxy_set_header        Authorization "Basic Zm9vOmJhcg==";
    proxy_ssl_server_name on;
}

But now the actual requests do not work properly any more:

<Error>
<Code>AccessDenied</Code>
<Message>Access Denied</Message>
<RequestId>***redacted***</RequestId>
<HostId>***redacted***</HostId>
</Error>

I assume that NGINX must make different requests now. But there seem only complex ways involving NJS/Lua to log the full requests.

Does anybody have a hint what's going on there? How can this be debugged?

EDIT: I added proxy_cache off to both, the old and the new configuration to make sure that the working asset is not cached -> but the result is the same, with the new config it does not work.

EDIT2:

I am trying this approach to log headers:

https://stackoverflow.com/a/55689741/288568

But it seems to log the incoming headers, not the headers I am setting via proxy_set_header

1
+250

Seems like a duplicate of question: https://stackoverflow.com/questions/46230270/nginx-using-variable-in-proxy-pass-breaks-routing

My guess is that it's sending https://upstream.example.com/assets/assets/.

When variabilizing, try and set proxy_pass to https://$backend_website$request_uri;

1
  • yes, seems to be the same problem. I believe it cannot use $request_uri because the concatenation caused problems with Chinese letters in the URL in the past. Anyways, I realized that I was able to simplify my proxy configuration (by matching location /.* and not location /assets) so that this problem does not apply anymore. – Alex May 14 at 5:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.