nginx reverse proxy with query parameter modification

Question

I have an application that is not SSL aware behind nginx, thus I need to do the following

http://example.com/f1/f2/page?next_page=http%3A//example.com/f3/new_page 

has to change to

https://example.com/f1/f2/page?next_page=https%3A//example.com/f3/new_page 

So there's two things to do, change the scheme, which I was able to, and change the url param, which I've been somewhat successfull at, but it doesn't work completely.

I found a page that did what I want to do, but it doesn't work for me: https://blog.imaginea.com/modifying-query-parameters-nginx-in-reverse-proxy-mode/

relevant part of my nginx config:

server { listen 443 ssl; server_name example.com; ssl on; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_certificate /path/to/bundle.crt; ssl_certificate_key /path/to/bundle.key; ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4; ssl_prefer_server_ciphers on; underscores_in_headers on; rewrite_log on; location / { if ($args ~* (.*)(next_page=http%3A)(.*)) { set $args $1next_page=https%3A$3; rewrite ^(.*)$ $1; } proxy_pass http://127.0.0.1:80; proxy_redirect http:// https://; proxy_set_header Host $host; proxy_set_header HTTPS "on"; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-Host $host:$server_port; proxy_set_header X-Forwarded-Server $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-Port 443; } } 

nginx_error.log:

2017/09/20 13:48:13 [notice] 25115#0: *1 "(.*)(next_page=http%3A)(.*)" matches "next_page=http%3A//example.com/f3/new_page", client: X.X.X.X, server: example.com, request: "GET /f1/f2/page?next_page=http%3A//example.com/f3/new_page HTTP/1.1", host: "example.com" 2017/09/20 13:48:13 [notice] 25115#0: *1 "^(.*)$" matches "/f1/f2/page", client: X.X.X.X, server: example.com, request: "GET /f1/f2/page?next_page=http%3A//example.com/f3/new_page HTTP/1.1", host: "example.com" 2017/09/20 13:48:13 [notice] 25115#0: *1 rewritten data: "/f1/f2/page", args: "next_page=https3A//example.com/f3/new_page", client: X.X.X.X, server: example.com, request: "GET /f1/f2/page?next_page=http%3A//example.com/f3/new_page HTTP/1.1", host: "example.com" 2017/09/20 13:48:13 [notice] 25115#0: *1 "(.*)(next_page=http%3A)(.*)" does not match "next_page=https3A//example.com/f3/new_page", client: X.X.X.X, server: example.com, request: "GET /f1/f2/page?next_page=http%3A//example.com/f3/new_page HTTP/1.1", host: "example.com" 2017/09/20 13:48:13 [notice] 25115#0: *1 "(.*)(next_page=http%3A)(.*)" does not match "", client: X.X.X.X, server: example.com, request: "GET /f1/f2/cookie/++resource++baseimg/regio.ico HTTP/1.1", host: "example.com", referrer: "https://example.com/f1/f2/page?next_page=http%3A//example.com/f3/new_page" 

So the scheme get's changed by the proxy_redirect (I need to do this since occassionally the application itself will redirect to some http-URI), proxy_pass forwards it to the correct server and the args get changed, but the request does not. What am I missing here?

URL as shown in browser:

https://example.com/f1/f1/page?next_page=http%3A//example.com/f3/new_page 

btw. nginx version is 1.10.1 and I am not able to upgrade it at this point

Answer 1

So, what ended up working was changing

if ($args ~* (.*)(next_page=http%3A)(.*)) { set $args $1next_page=https%3A$3; rewrite ^(.*)$ $1; } proxy_pass http://127.0.0.1:80; proxy_redirect http:// https://; 

to

if ($args ~* (.*)(next_page=http%3A)(.*)) { set $args $1next_page=https%3A$3; rewrite ^.*$ $1 redirect; } proxy_pass http://127.0.0.1:80$uri$is_args$args; proxy_redirect http:// https://; 

Answer 2

One possible issue is that nginx might not allow setting over the variables it defines by itself. I don't know this for sure, it is an educated guess.

This means that you should use a different name for the arguments.

Even better is to use the map feature to get the new query arguments.

In the http level of configuration, add the following map:

map $args $newargs { default $args; ~^(.*)next_page=http:(.*)$ $1next_page=https:$2; } 

And in your server block, use the following location:

location / { proxy_pass http://127.0.0.1:80$uri$is_args$newargs; ... } 

Anyway, your setup looks kind of odd, since you are proxying to the http port, which I presume is running on nginx on the server... I would simply do a redirect to https on all requests to the http port.