fix(nginx): use backend hostname in Host header to prevent ALB routing loops - #37
fix(nginx): use backend hostname in Host header to prevent ALB routing loops#37schivmeister wants to merge 1 commit into
Conversation
When proxying /api/* requests through an ALB with Host-based routing, nginx was forwarding the original request's Host header ($host). This caused the ALB to route back to the webapp instead of the backend, creating an infinite loop until X-Forwarded-For reached 30 IPs (HTTP 463). Changed proxy_set_header Host from $host to $backend_url.
There was a problem hiding this comment.
🟢 Ready to approve
The change is small and aligned with the stated deployment issue; only a minor comment/doc accuracy improvement was identified.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Pull request overview
Updates the Nginx reverse-proxy configuration for /api/* to avoid ALB Host-based routing loops by ensuring the proxied request uses the backend’s host in the Host header rather than the incoming request host.
Changes:
- Changed
proxy_set_header Hostfrom$hostto the backend-derived value to prevent ALB routing loops. - Added inline comments explaining the rationale for the Host header change.
File summaries
| File | Description |
|---|---|
src/infra/nginx.conf |
Adjusts Host header behavior for /api/ proxying to avoid ALB Host-based routing loops. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Low
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
| # Use the backend hostname, not the incoming request's Host. | ||
| # Prevents routing loops when an ALB uses Host-based routing. | ||
| proxy_set_header Host $backend_url; |
There was a problem hiding this comment.
The suggestion to use $proxy_host won't work -- it's only populated for static upstreams.
| proxy_set_header Host $host; | ||
| # Use the backend hostname, not the incoming request's Host. | ||
| # Prevents routing loops when an ALB uses Host-based routing. | ||
| proxy_set_header Host $backend_url; |
There was a problem hiding this comment.
But this will have to be tested in the OP Sandbox, right?
There was a problem hiding this comment.
Not possible due to limited subnet. Hence https://github.com/meaningfy-ws/entity-resolution-ops/pull/30.
|
Keeping this open as we do not yet have confirmation that this worked in client's environments (they definitely installed the stack but it could have been handled by them in another way). |
Summary
Fixes HTTP 463 errors when the webapp is deployed behind an ALB with Host-based routing (e.g., OP acceptance environment).
Problem
When proxying
/api/*requests, nginx was forwarding the original request's Host header ($host). In environments where an internal ALB routes based on Host header value, this caused requests to loop back to the webapp instead of reaching the curation-api.The loop continued until
X-Forwarded-Forreached 30 IPs, at which point the ALB rejected the request with HTTP 463.Solution
Changed
proxy_set_header Hostfrom$hostto$backend_urlso the ALB routes to the correct target group.Backward Compatibility
This change is backward compatible with direct routing scenarios (Docker Compose, AWS Cloud Map) where the Host header is ignored by the backend.
Testing
Verified locally using a simulated ALB with Host-based routing (see meaningfy-ws/entity-resolution-ops#30).