Modify the `Host` header or pass `X-Forwarded-Host` when using Nginx as a reverse proxy?

Question

I'm trying to use Nginx as a reverse proxy and the upstream server is an ASP.NET Core application where I've registered the ForwardedHeadersMiddleware, which will read three different X-Forwarded-* headers:

X-Forwarded-For
X-Forwarded-Proto
X-Forwarded-Host

Now, I understand the first two, but find the last one (X-Forwarded-Host) confusing. It seems to me that effectively this has the same effect as just having the proxy rewrite the Host header, and I've seen Nginx reverse proxy configurations doing exactly that, like so:

location / {
    proxy_pass http://app;
    proxy_set_header Host $host;
}

But then I've also seen the X-Forwarded-Host being used instead:

location / {
    proxy_pass http://app;
    proxy_set_header X-Forwarded-Host $host;
}

In some cases both are used at the same time — which makes zero sense to me:

location / {
    proxy_pass http://app;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Host $host;
}

I'm not sure what I should do. Why would you use both at the same time? Isn't it more idiomatic (or more "correct") to use X-Forwarded-Host (if your upstream server supports it) than rewriting Host? Changing Host feels like a hack to me. I've noticed that the result in my ASP.NET Core app will be the same regardless of whether I set Host or X-Forwarded-Host (or both), in either case, HttpContext.Request.Host is set to the expected value — provided that the forwarded headers middleware is registered, of course.

To my surprise, I couldn't find any relevant information on this issue by googling, so I had to ask this here. What is the right approach to take in this situation?

Does this answer your question? [Real life usage of the X-Forwarded-Host header?](https://stackoverflow.com/questions/19084340/real-life-usage-of-the-x-forwarded-host-header) — Christoph Lütjen, Dec 01 '22 at 15:43
@ChristophLütjen I don't think so, I did actually check out that question before posting mine. — Arad Alvand, Dec 01 '22 at 15:43
Your app might need two different hosts. a) the domain of the app itself (e.g. "app1.myinternalcluster") and the external domain, required for e.g. ``. So we need the `Host` header to tell the backend server which app should be started and the `X-Forwarded-Host` to allow the app to know the external host. IF your .Net app has it's own IP and it doesn't matter which Host you set, then there should not be a difference. Or did I misunderstand the question? — Christoph Lütjen, Dec 01 '22 at 15:52
In modern environments like kubernetes it's quite common, that every app has its own IP but imagine an example where we run 5 PHP apps and want to run them on two servers with a reverse proxy to allow us to shutdown one server and keep the app running. Here we would need the Host header to tell the backend server which of those 5 apps should be used and the X-Forwarded-Host header to allow the PHP app to output the correct external host. — Christoph Lütjen, Dec 01 '22 at 16:05

Modify the `Host` header or pass `X-Forwarded-Host` when using Nginx as a reverse proxy?

0 Answers0