From 04f3cbb63fde00f5a5732d66cb1e86ba77a803ec Mon Sep 17 00:00:00 2001 From: Pierre Brisorgueil Date: Tue, 27 Oct 2026 08:05:18 +0100 Subject: [PATCH] fix(nginx): relative Location on every redirect behind a TLS proxy The image's nginx listens on plain HTTP, so when TLS ends at an upstream proxy a directory redirect (/about -> /about/) carried an absolute Location: http://host/about/. absolute_redirect off at server level makes every redirect relative, so the browser keeps the public scheme and host. Closes #4784 Claude-Session: https://claude.ai/code/session_012XGDJoHpND6B3qk6SCWKmU --- nginx.example.conf | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/nginx.example.conf b/nginx.example.conf index afb24c53d..bb546a6d3 100644 --- a/nginx.example.conf +++ b/nginx.example.conf @@ -4,6 +4,10 @@ server { root /usr/share/nginx/html; + # Relative Location on every redirect nginx sends (directory slash, `return`): + # TLS ends at the upstream proxy, so an absolute one would point at http://. + absolute_redirect off; + # ── Baseline security headers ────────────────────────────────────────────── # `always` ensures the headers are emitted on error responses (4xx/5xx) too. add_header X-Content-Type-Options "nosniff" always;