paul/picpeak
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Merge pull request #548 from the-luap/fix/nginx-forwarded-proto-547

Browse Source 
fix(nginx): honour outer X-Forwarded-Proto when behind a reverse proxy (#547)
This commit is contained in:
Paul Nothaft
2026-05-22 14:40:55 +02:00
committed by GitHub
parent 6b6ac64346 5488de3383
commit b351d17ee9
2 changed files with 28 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/nginx.conf
+19 -8
View File
@@ -1,3 +1,14 @@
# Honour the outer reverse proxy's X-Forwarded-Proto when present (e.g. NPM,
# Traefik, Caddy in front of PicPeak). Falls back to nginx's own $scheme when
# the header is absent (direct access / no outer proxy). Without this the
# inner nginx was always forwarding "http" to the backend because the outer
# proxy → inner nginx hop is plain HTTP, breaking Secure cookies and HTTPS
# URL generation in the backend. See issue #547.
map $http_x_forwarded_proto $real_proto {
default $http_x_forwarded_proto;
"" $scheme;
}
server {
listen 80;
server_name localhost;
@@ -80,7 +91,7 @@ server {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Proto $real_proto;
proxy_cache_bypass $http_upgrade;
proxy_read_timeout 86400;
@@ -97,7 +108,7 @@ server {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Proto $real_proto;
# Cache photos
proxy_cache_valid 200 302 1d;
@@ -112,7 +123,7 @@ server {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Proto $real_proto;
# Cache thumbnails
proxy_cache_valid 200 302 7d;
@@ -128,7 +139,7 @@ server {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Proto $real_proto;
# Cache uploads
proxy_cache_valid 200 302 7d;
@@ -146,7 +157,7 @@ server {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Proto $real_proto;
# Fonts rarely change; cache aggressively (matches backend Cache-Control).
proxy_cache_valid 200 302 7d;
@@ -161,7 +172,7 @@ server {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Proto $real_proto;
}
# Delegate root requests to backend for public landing page handling
@@ -175,7 +186,7 @@ server {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Proto $real_proto;
proxy_read_timeout 60s;
}
@@ -203,7 +214,7 @@ server {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Proto $real_proto;
}
# SPA fallback
frontend/nginx.dev.conf
+9 -2
View File
@@ -1,3 +1,10 @@
# Honour outer reverse-proxy's X-Forwarded-Proto when present (see #547 /
# frontend/nginx.conf for full rationale).
map $http_x_forwarded_proto $real_proto {
default $http_x_forwarded_proto;
"" $scheme;
}
server {
listen 80;
server_name localhost;
@@ -10,7 +17,7 @@ server {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Proto $real_proto;
}
# Photos proxy to backend
@@ -41,7 +48,7 @@ server {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Proto $real_proto;
}
# SPA fallback