Fix proxy full redirect

Author: mesudip

nginx_proxy/Host.py

@@ -28,6 +28,7 @@ def __init__(self, hostname: str, port: int, scheme=None):
         self.scheme: set = scheme
         self.secured: bool = "https" in scheme or "wss" in scheme
         self.full_redirect: Union[Url, None] = None
+        self.is_redirect: bool = False
         self.extras: Dict[str, Any] = {}
 
     def set_external_parameters(self, host, port) -> None:

nginx_proxy/WebServer.py

@@ -96,13 +96,14 @@ def _ensure_https_redirects(self, hosts: List[Host]) -> List[Host]:
         http_hosts = {(host.hostname, int(host.port)): host for host in hosts if int(host.port) == 80}
 
         for host in hosts:
-            if not host.secured or int(host.port) == 80:
+            if host.is_redirect or not host.secured or int(host.port) == 80:
                 continue
             redirect_target = Url({"https"}, host.hostname, int(host.port), "/")
             http_host = http_hosts.get((host.hostname, 80))
             if http_host is None:
                 redirect_host = Host(host.hostname, 80)
                 redirect_host.full_redirect = redirect_target
+                redirect_host.update_extras_content("redirect_status_code", "308")
                 # Added after redirect post-processing, so mark it explicitly for template rendering.
                 redirect_host.is_redirect = True
                 redirect_hosts.append(redirect_host)

nginx_proxy/post_processors/redirect_processor.py

@@ -10,7 +10,7 @@ def process_redirection(self, config: ProxyConfigData):
         for host in config.host_list():
             if host.isredirect():
                 redirected_hosts[host.hostname] = host.full_redirect
-                target = config.getHost(host.full_redirect.hostname)
+                target = config.getHost(host.full_redirect.hostname, host.full_redirect.port)
                 if target is not None:
                     if target.hostname == host.hostname:
                         host.full_redirect = None

nginx_proxy/pre_processors/redirect_processor.py

@@ -23,16 +23,25 @@ def process_redirection(backend: BackendTarget, environments: map, vhost_map: Di
             if len(split) == 2:
                 _sources, target = split
                 sources = [Url.parse(source) for source in _sources.split(",")]
-                target = Url.parse(target, default_port=80)
-                if single_host:
-                    if target.hostname is None:
-                        target = single_host
+                target = Url.parse(target)
+                if target.hostname is None and single_host:
+                    target.hostname = hosts[0].hostname
                 elif target.hostname is None:
                     print("Unknown target to redirect with PROXY_FULL_REDIRECT" + redirect_entry)
                     continue
+                target.port = int(target.port) if target.port is not None else None
+                if target.port is None and target.hostname in vhost_map:
+                    target_host = vhost_map[target.hostname].get(443) or vhost_map[target.hostname].get(80)
+                    if target_host is not None:
+                        target.port = target_host.port
+                        target.scheme = {"https"} if target_host.secured else {"http"}
+                if target.port is None:
+                    target.port = 443 if "https" in target.scheme or "wss" in target.scheme else 80
+                if not target.scheme:
+                    target.scheme = {"https"} if target.port == 443 else {"http"}
                 for source in sources:
                     if source.hostname is not None:
-                        port = 80 if source.port is None else source.port
+                        port = 80 if source.port is None else int(source.port)
                         if source.hostname not in vhost_map:
                             host = Host(source.hostname, port)
                             host.full_redirect = target

tests/integration/conftest.py

@@ -132,7 +132,6 @@ def nginx_proxy_container(docker_client: docker.DockerClient, test_network, dock
             name=container_name,
             environment={
                 "LETSENCRYPT_API": "https://acme-staging-v02.api.letsencrypt.org/directory",
-                "DHPARAM_SIZE": "256",
                 "VHOSTS_TEMPLATE_DIR": "/app/vhosts_template",
                 "CHALLENGE_DIR": "/etc/nginx/acme-challenges",
                 "DOCKER_SWARM": swarm_mode,

tests/integration/test_nginx_proxy.py

@@ -200,6 +200,68 @@ def test_http_to_https_redirect_preserves_query_string(nginx_request, docker_cli
             stop_backend(backend)
 
 
+@pytest.mark.parametrize("backend_type", ["container", "service"])
+def test_proxy_full_redirect_to_https_target_response(
+    nginx_request,
+    docker_client,
+    test_network,
+    swarm_mode,
+    backend_type,
+    request,
+):
+    """
+    Test that PROXY_FULL_REDIRECT returns a 301 to the existing HTTPS target
+    while preserving the original request URI.
+    """
+    if not is_reachable(swarm_mode, backend_type):
+        pytest.skip("Backend discovery not available for this swarm mode/backend type combination.")
+
+    suffix = f"{backend_type}.{swarm_mode}.{datetime.now(timezone.utc).strftime('%H%M%S%f')}"
+    target_host = f"{suffix}.full-redirect-target.example.com"
+    source_host = f"{suffix}.full-redirect-source.example.com"
+    env = {
+        "VIRTUAL_HOST": f"https://{target_host} -> :8080",
+        "VIRTUAL_PORT": "8080",
+        "PROXY_FULL_REDIRECT": f"{source_host} -> {target_host}",
+    }
+    backend = None
+
+    try:
+        backend = start_backend(
+            docker_client,
+            test_network,
+            env,
+            backend_type=backend_type,
+            pytest_request=request,
+            sleep=False,
+        )
+
+        request_uri = "/v2/_catalog?n=50&last=abc"
+        url = f"http://{source_host}{request_uri}"
+
+        response = None
+        ex = None
+        for _ in range(20):
+            try:
+                ex = None
+                response = nginx_request.get(url, timeout=2, allow_redirects=False)
+                if response.status_code == 301:
+                    break
+            except (KeyboardInterrupt, SystemExit):
+                raise
+            except Exception as e:
+                ex = e
+            time.sleep(1)
+
+        assert ex is None
+        assert response is not None
+        assert response.status_code == 301
+        assert response.headers.get("Location") == f"https://{target_host}{request_uri}"
+    finally:
+        if backend:
+            stop_backend(backend)
+
+
 @pytest.mark.parametrize("backend_type", ["container", "service"])
 @pytest.mark.parametrize(
     "virtual_host_base, request_path",

tests/integration/test_webserver_events.py

@@ -352,6 +352,55 @@ def test_webserver_add_container_with_ssl_integration(
             stop_backend(backend)
 
 
+@pytest.mark.parametrize("backend_type", ["container", "service"])
+def test_proxy_full_redirect_to_https_target_integration(
+    nginx_proxy_container: docker.models.containers.Container,
+    docker_client: docker.DockerClient,
+    test_network: docker.models.networks.Network,
+    backend_type: str,
+):
+    """
+    Test that PROXY_FULL_REDIRECT resolves a bare target to the existing HTTPS vhost
+    and renders a documented 301 redirect without appending :80.
+    """
+    suffix = uuid.uuid4().hex[:6]
+    target_host = f"{backend_type}.full-redirect-target-{suffix}.example.com"
+    source_host = f"{backend_type}.full-redirect-source-{suffix}.example.com"
+    env = {
+        "VIRTUAL_HOST": f"https://{target_host} -> :8080",
+        "VIRTUAL_PORT": "8080",
+        "PROXY_FULL_REDIRECT": f"{source_host} -> {target_host}",
+    }
+
+    backend = start_backend(docker_client, test_network, env, backend_type=backend_type, sleep=False)
+    try:
+        redirect_server = None
+        for _ in range(25):
+            config_str = get_nginx_config_from_container(nginx_proxy_container[0])
+            config = HttpBlock.parse(config_str)
+            redirect_server = next((s for s in config.servers if source_host in s.server_names), None)
+            if redirect_server is not None:
+                redirect_loc = next((loc for loc in redirect_server.locations if loc.path == "/"), None)
+                if redirect_loc and redirect_loc.return_code == f"301 https://{target_host}$request_uri":
+                    break
+            time.sleep(1)
+
+        config_str = get_nginx_config_from_container(nginx_proxy_container[0])
+        config = HttpBlock.parse(config_str)
+        target_servers = [s for s in config.servers if target_host in s.server_names]
+        source_servers = [s for s in config.servers if source_host in s.server_names]
+
+        assert any("443" in s.listen for s in target_servers), f"HTTPS target server not found. Config:\n{config_str}"
+        assert len(source_servers) == 1, f"Expected one redirect source server. Config:\n{config_str}"
+
+        redirect_loc = next((loc for loc in source_servers[0].locations if loc.path == "/"), None)
+        assert redirect_loc is not None, f"Redirect location not found. Config:\n{config_str}"
+        assert redirect_loc.return_code == f"301 https://{target_host}$request_uri"
+    finally:
+        if backend:
+            stop_backend(backend)
+
+
 @pytest.mark.parametrize("backend_type", ["container", "service"])
 def test_webserver_add_two_containers_with_same_virtual_host_integration(
     nginx_proxy_container,

tests/unit/test_webserver_events.py

@@ -412,6 +412,43 @@ def test_webserver_add_container_with_ssl(docker_client: DockerTestClient, nginx
     assert http_redirect_location.return_code == "308 https://ssl.example.com$request_uri"
 
 
+def test_proxy_full_redirect_uses_existing_https_target(docker_client: DockerTestClient, nginx: DummyNginx):
+    target_hostname = "redirect-target.example.com"
+    source_hostname = "redirect-source.example.com"
+    alternate_source = "redirect-source-www.example.com"
+    env = {
+        "VIRTUAL_HOST": f"https://{target_hostname}",
+        "PROXY_FULL_REDIRECT": f"{source_hostname},{alternate_source} -> {target_hostname}",
+    }
+
+    docker_client.containers.run("nginx:alpine", name="full_redirect_https", environment=env, network="frontend")
+
+    target_servers = expect_servers(nginx, target_hostname, 2)
+    assert next((s for s in target_servers if "443" in s.listen), None) is not None
+
+    for hostname in (source_hostname, alternate_source):
+        redirect_server = expect_server(nginx, hostname)
+        redirect_location = next((l for l in redirect_server.locations if l.path == "/"), None)
+        assert redirect_location is not None
+        assert redirect_location.return_code == f"301 https://{target_hostname}$request_uri"
+
+
+def test_proxy_full_redirect_preserves_http_target_scheme(docker_client: DockerTestClient, nginx: DummyNginx):
+    target_hostname = "redirect-http-target.example.com"
+    source_hostname = "redirect-http-source.example.com"
+    env = {
+        "VIRTUAL_HOST": target_hostname,
+        "PROXY_FULL_REDIRECT": f"{source_hostname} -> {target_hostname}",
+    }
+
+    docker_client.containers.run("nginx:alpine", name="full_redirect_http", environment=env, network="frontend")
+
+    redirect_server = expect_servers(nginx, source_hostname, 1)[0]
+    redirect_location = next((l for l in redirect_server.locations if l.path == "/"), None)
+    assert redirect_location is not None
+    assert redirect_location.return_code == f"301 http://{target_hostname}$request_uri"
+
+
 def test_webserver_ssl_does_not_override_explicit_http_location(docker_client: DockerTestClient, nginx: DummyNginx):
     container_name = "ssl_http_container"
     hostname = "ssl-http.example.com"

vhosts_template/default.conf.jinja2

@@ -84,8 +84,8 @@ server {
             alias {{ config.challenge_dir }};
             try_files $uri =404;{% endif %}
         }
-        location / { {% if server.is_redirect %}
-                return 308 https://{{ server.full_redirect.hostname }}{% if server.full_redirect.port and server.full_redirect.port != 443 %}:{{ server.full_redirect.port }}{% endif %}$request_uri;{% else %}
+        location / { {% if server.is_redirect %}{% set redirect_scheme = "https" if "https" in server.full_redirect.scheme or "wss" in server.full_redirect.scheme else "http" %}
+                return {{ server.extras.redirect_status_code if server.extras.redirect_status_code else "301" }} {{ redirect_scheme }}://{{ server.full_redirect.hostname }}{% if server.full_redirect.port and ((redirect_scheme == "https" and server.full_redirect.port != 443) or (redirect_scheme == "http" and server.full_redirect.port != 80)) %}:{{ server.full_redirect.port }}{% endif %}$request_uri;{% else %}
                 return 308 https://$host$request_uri;{% endif %}
         }
 }{% endif %}{% endfor %}