From 5facce617ba816e336b0dd7e849db1eb4400b496 Mon Sep 17 00:00:00 2001 From: Gluek Date: Mon, 19 Oct 2026 00:26:38 +0100 Subject: [PATCH] fix(nginx): don't leak internal port 8443 in directory redirects nginx listens on 127.0.0.1:8443 behind the stream proxy on port 443. For a directory requested without a trailing slash, nginx built an absolute Location header with its own port, e.g. https://example.org:8443/apps/, which is unreachable from outside. With absolute_redirect off, nginx sends a relative Location: /apps/. --- cmdeploy/src/cmdeploy/nginx/nginx.conf.j2 | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/cmdeploy/src/cmdeploy/nginx/nginx.conf.j2 b/cmdeploy/src/cmdeploy/nginx/nginx.conf.j2 index 2e2abf3e..d8917d46 100644 --- a/cmdeploy/src/cmdeploy/nginx/nginx.conf.j2 +++ b/cmdeploy/src/cmdeploy/nginx/nginx.conf.j2 @@ -68,6 +68,11 @@ http { listen 127.0.0.1:8443 ssl default_server; + # nginx is reached through the stream proxy on port 443, + # so redirects it generates itself (e.g. /dir -> /dir/) + # must not contain the internal port 8443. + absolute_redirect off; + root {{ www_root }}; index index.html index.htm;