From 80c84a33316d495d42139f9e2693a7e1d7dd1c41 Mon Sep 17 00:00:00 2001 From: Andrey Antukh Date: Wed, 22 Jul 2026 14:00:35 +0200 Subject: [PATCH] :bug: Strip Authorization header when proxying asset redirects to S3 (#10777) When nginx follows a backend 307 redirect to a presigned S3 URL, it was forwarding the client's Authorization header to S3. Production S3 rejects this because it sees two auth mechanisms (presigned URL signature + Authorization header). MinIO in devenv is more lenient and ignores the extra header. Fix: add proxy_set_header Authorization "" in the @handle_redirect block. Fixes #10776 AI-assisted-by: mimo-v2.5-pro --- docker/devenv/files/nginx.conf | 1 + docker/images/files/nginx.conf.template | 1 + 2 files changed, 2 insertions(+) diff --git a/docker/devenv/files/nginx.conf b/docker/devenv/files/nginx.conf index ce5566079f..3d3d70263f 100644 --- a/docker/devenv/files/nginx.conf +++ b/docker/devenv/files/nginx.conf @@ -86,6 +86,7 @@ http { set $real_mtype "$upstream_http_x_mtype"; proxy_set_header Host "$redirect_host"; + proxy_set_header Authorization ""; proxy_hide_header etag; proxy_hide_header x-amz-id-2; proxy_hide_header x-amz-request-id; diff --git a/docker/images/files/nginx.conf.template b/docker/images/files/nginx.conf.template index a27d770f82..95ddf348a1 100644 --- a/docker/images/files/nginx.conf.template +++ b/docker/images/files/nginx.conf.template @@ -94,6 +94,7 @@ http { proxy_buffering off; proxy_set_header Host "$redirect_host"; + proxy_set_header Authorization ""; proxy_hide_header etag; proxy_hide_header x-amz-id-2; proxy_hide_header x-amz-request-id;