Add absolute_redirect off; to prevent broken redirects in containerized environments

[beliven-valentino-cossar]

Hello, I would like to propose adding the directive absolute_redirect off; to both http.conf.template and https.conf.template.

Reason and usefulness
When running Nginx inside containerized environments, it is common to have the service listen on a non-standard internal port (e.g., 8080, 8443) which is then mapped to the standard port (80 or 443) on the host. Without absolute_redirect off;, Nginx may generate absolute redirects that include the internal container port (like :8080 or :8443) in the Location header. This can break client-side navigation and create confusion, since users actually connect through the standard external ports.

By explicitly adding absolute_redirect off;, Nginx will use relative redirects instead. This ensures that URLs generated in redirects will not leak internal port numbers to external users, providing a more seamless experience across various deployment environments, especially with containerized setups and reverse proxy scenarios.

Example
Without absolute_redirect off;, accessing https://mydomain.com/path may redirect to https://mydomain.com:8443/path/ if Nginx listens on 8443 inside the container. With absolute_redirect off;, the redirect will use a relative URL and will not expose the internal port to the client.

This is the https.conf.template file as example.

listen 8443 ssl default_server;
listen [::]:8443 ssl default_server;
http2 on;

root $NGINX_WEBROOT;

ssl_certificate $SSL_CERTIFICATE_FILE;
ssl_certificate_key $SSL_PRIVATE_KEY_FILE;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_protocols TLSv1.2 TLSv1.3;

# Set allowed "index" files
index index.html index.htm index.php;

server_name _;

charset utf-8;

absolute_redirect off;

# Set max upload to 2048M
client_max_body_size 2048M;

# Healthchecks: Set /healthcheck to be the healthcheck URL
location /healthcheck {
    access_log off;

    # set max 5 seconds for healthcheck
    fastcgi_read_timeout 5s;

    include        fastcgi_params;
    fastcgi_param  SCRIPT_NAME     /healthcheck;
    fastcgi_param  SCRIPT_FILENAME /healthcheck;
    fastcgi_pass   127.0.0.1:9000;
}

# Have NGINX try searching for PHP files as well
location / {
    try_files $uri $uri/ /index.php?$query_string;
}

# Pass "*.php" files to PHP-FPM
location ~ \.php$ {
    fastcgi_pass   127.0.0.1:9000;
    fastcgi_index  index.php;
    fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
    include        fastcgi_params;
    fastcgi_buffers $NGINX_FASTCGI_BUFFERS;
    fastcgi_buffer_size $NGINX_FASTCGI_BUFFER_SIZE;
    fastcgi_read_timeout $PHP_MAX_EXECUTION_TIME;
}

# additional config
include /etc/nginx/server-opts.d/*.conf;

If you prefer, I could submit a PR.

Thank you for considering this improvement!

[jaydrogers]

Great proposal! Thanks for bringing this to my attention.

I just added this here: 077fd62

This will be available in v4.0, but you can start testing it today 🥳

• Release 4.0: Add FrankenPHP & more Laravel optmizations #283

[beliven-valentino-cossar]

Hi @jaydrogers, super! Thank you 🙏