Skip to content

fix(nginx): disable port_in_redirect to fix internal port leakage in redirects#411

Open
Copilot wants to merge 4 commits intomainfrom
copilot/fix-x-forwarded-port-headers
Open

fix(nginx): disable port_in_redirect to fix internal port leakage in redirects#411
Copilot wants to merge 4 commits intomainfrom
copilot/fix-x-forwarded-port-headers

Conversation

Copy link

Copilot AI commented Mar 1, 2026

  • Explore codebase and understand the issue
  • Add port_in_redirect off; to both HTTP and HTTPS server blocks in default.conf.template
  • Add breaking change note in README.md for users relying on the old behavior
  • Run code review - no issues found
Original prompt

This section details on the original issue you should resolve

<issue_title>Alpine image does not respect x-forwarded-port headers</issue_title>
<issue_description>This issue (issue #40) still exists, and apparently setting NGINX_X_FORWARDED_PORT does not work. Any additional backends listed at /address/* will result in a redirect to the internal ports of 8080 or 8443 regardless of the docker port proxying configuration if we visit /address for example (so the nginx will want to redirect this to /address/ but somehow the modsec-crs image is putting the internal ports in here, inappropriately)</issue_description>

Comments on the Issue (you are @copilot in this section)


💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

…warded-Port

Co-authored-by: fzipi <3012076+fzipi@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix Alpine image to respect x-forwarded-port headers nginx: disable port_in_redirect to fix internal port leakage in redirects Mar 1, 2026
Copilot finished work on behalf of fzipi March 1, 2026 16:54
@fzipi fzipi marked this pull request as ready for review March 1, 2026 17:42
@fzipi fzipi changed the title nginx: disable port_in_redirect to fix internal port leakage in redirects fix(nginx): disable port_in_redirect to fix internal port leakage in redirects Mar 1, 2026
@fzipi fzipi enabled auto-merge March 1, 2026 20:57
theseion
theseion previously approved these changes Mar 2, 2026
@fzipi
Copy link
Member

fzipi commented Mar 2, 2026

@copilot Add a comment in the README.md about this change, it might be breaking for those users that rely on the old behavior.

Co-authored-by: fzipi <3012076+fzipi@users.noreply.github.com>
auto-merge was automatically disabled March 2, 2026 10:31

Head branch was pushed to by a user without write access

Copy link
Author

Copilot AI commented Mar 2, 2026

@copilot Add a comment in the README.md about this change, it might be breaking for those users that rely on the old behavior.

Added a "Nginx port_in_redirect breaking change" section to README.md (commit 4283edb) that explains the behavior change and notes that users relying on the port being included in nginx-generated redirects will need to mount a custom default.conf.template to re-enable it.

Copilot finished work on behalf of fzipi March 2, 2026 10:32
@fzipi fzipi requested a review from theseion March 2, 2026 15:54
@fzipi
Copy link
Member

fzipi commented Mar 2, 2026

@theseion Added a note in the README to show it is breaking.

@fzipi fzipi enabled auto-merge March 3, 2026 06:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Alpine image does not respect x-forwarded-port headers

3 participants