Proxy_params by default blocks reverse proxy for HTTP/3

[DorianCoding]

Please use this template for troubleshooting questions.

My issue:

By default, proxy_params sent $http_host to proxy servers and not $host. However only HTTP/1 and HTTP/1.1 is available as proxy_pass.

How I encountered the problem:

If you use HTTP/3 in NGINX, there is no more Host: header in the request, as it is dealed during the TLS handshake. Therefore, proxies does not get Host: header which is however a requirement of HTTP/1.1 and reject with a 400 header Bad request without any logs.

Solutions I’ve tried:

The use by default of $host in proxy_params would solve or a specific param to set it only for HTTP/3.

Version of NGINX or NGINX adjacent software (e.g. NGINX Gateway Fabric): Nginx Debian 1.28.0

Deployment environment:

Minimal NGINX config to reproduce your issue (preferably running on https://tech-playground.com/playgrounds/nginx for ease of debugging, and if not as a code block):

Default nginx with a HTTP/3 enabled and HTTP/1.1 proxy_pass. Could not test on tech-playground as a certificate is compulsory.

Thank you.

[alessandro]

Hi @DorianCoding!

Your overall assessment is correct, but I am not entirely sure what you mean by proxy_params. Is that a file contained in your NGINX installation? If so, could you share the contents of the file and let us know where did you install NGINX from? There might be nothing we can tweak on our end to solve this issue

[liam]

Two possible solutions:

1. Use server_name to define the $host variable
2. Use the hostname from TLS ($ssl_server_name)

If you need something conditional based on HTTP version then

map $http3 $hostbyver {
    "" $host;
    default $ssl_server_name; # For HTTP/3 request, obtain from TLS handshake
}

server {
    listen …;
    location / {
        proxy_pass …;
        proxy_set_header Host $hostbyver;
    }
}

[DorianCoding]

Proxy_params is the default file from Debian package:

proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

Changing $http_host to $host solves the problem. I think @liam solution could work as well, but maybe is more or less the same as $host. My question is also: why it is not implemented by default as nginx provides HTTP/3 on stable?

[liam]

@DorianCoding

why it is not implemented by default as nginx provides HTTP/3 on stable?

Your complaint is with Debian. They are packaging NGINX with opinionated params.

From the docs Module ngx_http_proxy_module

An unchanged “Host” request header field can be passed like this:
proxy_set_header Host $http_host;
However, if this field is not present in a client request header then nothing will be passed. In such a case it is better to use the $host variable - its value equals the server name in the “Host” request header field or the primary server name if this field is not present:
proxy_set_header Host $host;