ASP.NET Core反向代理下触发307重定向问题求助

将ASP.NET Core Web API部署到Docker容器，通过Nginx反向代理提供SSL访问，请求路由链为example.com -> Nginx反向代理 -> actualserver.local:7066（Web API）。

Nginx配置如下：

worker_processes 1;

events { worker_connections 1024; }

http {
    client_max_body_size 0;
    sendfile on;

    proxy_set_header   Host $host;
    proxy_set_header   X-Real-IP $remote_addr;
    proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header   X-Forwarded-Host $server_name;

    server {
        listen 80 default_server;
        server_name example.com;
        return 301 https://$host$request_uri;
    }

    server {
        listen 443 ssl http2;
        ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
        server_name     example.com;

        location /api {
            proxy_pass         http://actualserver.local:7066/api;
            proxy_set_header   Upgrade $http_upgrade;
            proxy_set_header   Connection "Upgrade";
            proxy_set_header   X-Forwarded-Proto https;
            proxy_redirect     off;
        }

        location /swagger {
            proxy_pass         http://actualserver.local:7066/swagger;
            proxy_set_header   Upgrade $http_upgrade;
            proxy_set_header   Connection "Upgrade";
            proxy_set_header   X-Forwarded-Proto https;
            proxy_redirect     off;
        }

        location / {
            proxy_pass         http://actualserver.local:3000;
            proxy_set_header   Upgrade $http_upgrade;
            proxy_set_header   Connection "Upgrade";
            proxy_set_header   X-Forwarded-Proto https;
            proxy_redirect     off;
        }

        location /.well-known/acme-challenge/ {
            root /var/www/certbot;
        }
    }
}

Web API的docker-compose配置：

api:
  image: myprivateregistry.com/bcb.api:1.0.0.19
  restart: always
  ports:
    - 7066:80
  environment:
    SQL_SERVER: localhost
    MAIL_SERVER: 127.0.01

当前现象：

• 访问https://example.com可正常获取React应用内容
• 访问https://example.com/swagger/index.html可正常加载Swagger页面
• 调用API接口（如https://example.com/api/Authentication/login）时，ASP.NET Core返回HTTP 307重定向，目标地址为https://actualserver.local:7066/api/Authentication/login，导致请求失败
• 已尝试配置ForwardedHeadersOptions但无效果，添加UseHttpLogging()未生成日志

1. 修正ForwardedHeaders配置顺序与参数 #

ASP.NET Core的UseForwardedHeaders()必须放在路由、认证等中间件之前，同时要确保正确识别反向代理的IP（生产环境建议指定具体IP，测试环境可临时放宽限制）。

修改Program.cs：

var builder = WebApplication.CreateBuilder(args);

// 优先配置ForwardedHeaders
builder.Services.Configure<ForwardedHeadersOptions>(options =>
{
    options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
    // 替换为Nginx服务器的实际内网IP
    options.KnownProxies.Add(IPAddress.Parse("反向代理内网IP"));
    // 测试环境临时允许所有代理（生产不推荐）：
    // options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("0.0.0.0"), 0));
});

// 其他服务配置
builder.Services.AddControllers();
// ... 其他业务服务配置

var app = builder.Build();

// 必须在UseRouting、UseAuthentication之前调用
app.UseForwardedHeaders();

// 后续中间件配置
app.UseHttpsRedirection(); // 若代理已处理HTTPS，可考虑禁用或调整
app.UseRouting();
app.UseAuthentication();
app.UseAuthorization();

app.MapControllers();
app.Run();

2. 调整Nginx的Host头与X-Forwarded-Host配置 #

确保Nginx传递的主机头为客户端请求的公网域名，修正X-Forwarded-Host参数：

# 在http块中统一配置，覆盖所有location
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
# 将X-Forwarded-Host从$server_name改为$host，传递正确的公网域名
proxy_set_header X-Forwarded-Host $host;

3. 适配HTTPS重定向配置 #

由于后端Web API容器仅监听HTTP（docker映射7066到80），可调整HTTPS重定向逻辑：

// 方案1：直接禁用HTTPS重定向（代理已处理SSL）
// app.UseHttpsRedirection();

// 方案2：配置正确的公网HTTPS端口
builder.Services.Configure<HttpsRedirectionOptions>(options =>
{
    options.HttpsPort = 443;
});

4. 验证HttpLogging配置 #

确保正确添加日志服务并启用中间件：

builder.Services.AddHttpLogging(options =>
{
    options.LoggingFields = HttpLoggingFields.All;
});

// 在UseForwardedHeaders之后添加
app.UseHttpLogging();

通过Docker命令查看日志：docker logs <API容器名称>

内容的提问来源于stack exchange，提问作者Colin Dawson