github/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2026-08-14 16:58:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

🐛 Forward internal Host in nginx proxy_pass to backend/exporter (#11233)

Browse Source 
The global `proxy_set_header Host $http_host;` forwarded the client-facing
Host to internal proxy_pass calls (backend/exporter), breaking mTLS routing
in service-mesh setups (e.g. Istio STRICT mode), which match outbound
requests to a cluster based on Host/:authority.

Explicitly set `Host $proxy_host` on /api, /assets, /api/export, /readyz
and /ws/notifications so these calls always target the correct internal
service host, independent of the client's original Host header.

Fixes #10835

Signed-off-by: Sebastien MALOT <sebastien.malot@pm.gouv.fr>
Co-authored-by: Sebastien MALOT <sebastien.malot@pm.gouv.fr>
This commit is contained in:
Yamila Moreno 2026-08-13 12:03:27 +02:00 committed by GitHub
parent f7fc869e52
commit 9528400c6e
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
docker/images/files/nginx.conf.template
View File

@ -111,6 +111,7 @@ http {
}
location /assets {
proxy_set_header Host $proxy_host;
proxy_pass $PENPOT_BACKEND_URI/assets;
recursive_error_pages on;
proxy_intercept_errors on;
@ -127,10 +128,12 @@ http {
}
location /api/export {
proxy_set_header Host $proxy_host;
proxy_pass $PENPOT_EXPORTER_URI;
}
location /api {
proxy_set_header Host $proxy_host;
proxy_pass $PENPOT_BACKEND_URI/api;
proxy_buffering off;
}
@ -142,10 +145,12 @@ http {
location /readyz {
access_log off;
proxy_set_header Host $proxy_host;
proxy_pass $PENPOT_BACKEND_URI$request_uri;
}
location /ws/notifications {
proxy_set_header Host $proxy_host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_pass $PENPOT_BACKEND_URI/ws/notifications;