how to handle nginx reverse proxy https to http scheme redirect

Question

I have set up nginx as a reverse proxy on an ubuntu instance that is hosting jenkins, and a few other applications. I'm using nginx to route to the various applications based on a relative path. All traffic from the client to nginx is over https. Behind the firewall, nginx routes everything over http to the configured path and port numbers. It looks something like this:

              firewall
                |
                |
--->https--->nginx---http--->jenkins
                |
                |

The relevant part of the nginx config file is this:

server {

    listen 443 ssl;

    ssl_certificate cert.crt;
    ssl_certificate_key cert.key;
    ssl_session_cache builtin:1000 shared:SSL:10m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
    ssl_prefer_server_ciphers on;


    location /jenkins {

            proxy_set_header Host $http_host;
            proxy_set_header X-NginX-Proxy true;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

            proxy_pass http://127.0.0.1:6969;
    }

}

The problem is that jenkins uses a simple authentication, and upon a successful login, it sends a 302 redirect. Nginx correctly proxies the url and port, but not the scheme. So the client follows the redirect over http, instead of https. In the browser I then get a 400 error:

400 Bad Request The plain HTTP request was sent to HTTPS port

I know that there is a scheme variable: $scheme. But I don't know how to tell nginx to map the http redirect from jenkins to https. All the examples I've looked at on stackoverflow seem to address slightly different situations.

Answer 1

You probably need to rewrite the 302 redirect from upstream. Assuming everything else is correct, try:

proxy_redirect http:// https://;

See this document for details.

Answer 2

Ok, I was having the same problem and after some more research and couple of trial and error attempts I figured it out.

Try adding the header X-Forwarded-Proto as in the following example:

server {

    server_name example.com;
    proxy_set_header Host $host;

    # You need this line
    proxy_set_header X-Forwarded-Proto $scheme;

    location ^~ /jenkins {
        proxy_pass http://localhost:8080/;
    }

    listen 443 ssl;
    ssl_certificate cert.crt;
    ssl_certificate_key cert.key;
    ssl_session_cache builtin:1000 shared:SSL:10m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
    ssl_prefer_server_ciphers on;

}

The $scheme will handle https in the front end and then you can call http in the backend using the location.