Nginx访问出现ERR_TOO_MANY_REDIRECTS错误求助

问题场景 #

• VPS上为子域名backend.globeofarticles.com部署Nginx作为后端代理，后端服务运行在127.0.0.1:8000
• 前端部署在Cloudflare，对应主域名www.globeofarticles.com和globeofarticles.com
• 浏览器访问后端子域名时触发ERR_TOO_MANY_REDIRECTS错误，终端无报错
• 已确认：sudo nginx -T无语法错误，sudo systemctl status nginx显示服务正常运行

相关配置文件 #

/etc/nginx/nginx.conf #

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
        worker_connections 768;
        # multi_accept on;
}

http {

        ##
        # Basic Settings
        ##

        sendfile on;
        tcp_nopush on;
        tcp_nodelay on;
        keepalive_timeout 65;
        types_hash_max_size 2048;
        # server_tokens off;

        # server_names_hash_bucket_size 64;
        # server_name_in_redirect off;
        
        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        ##
        # SSL Settings
        ##

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
        ssl_prefer_server_ciphers on;

        ##
        # Logging Settings
         access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;

        ##
        # Gzip Settings
        ##

        gzip on;

        # gzip_vary on;
        # gzip_proxied any;
          access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;

        ##
        # Gzip Settings
        ##

        gzip on;

        # gzip_vary on;
        # gzip_proxied any;
        # gzip_comp_level 6;
        # gzip_buffers 16 8k;
        # gzip_http_version 1.1;
        # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/x$

        ##
        # Virtual Host Configs
        ##

        # # EDIT HERE include /etc/nginx/conf.d/*.conf;
        include /etc/nginx/sites-enabled/*;
}
#mail {
#       # See sample authentication script at:
#       # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
#       # auth_http localhost/auth.php;
#       # pop3_capabilities "TOP" "USER";
#       # imap_capabilities "IMAP4rev1" "UIDPLUS";
#
#       server {
#               listen     localhost:110;
#               protocol   pop3;
#               proxy      on;
#
#       server {
#               listen     localhost:143;
#               protocol   imap;
#               proxy      on;
#       }
#}

/etc/nginx/sites-enabled/ArticleWebsite #

server_tokens               off;
access_log                  /var/log/nginx/ArticleWebsite.access.log;
error_log                   /var/log/nginx/ArticleWebsite.error.log;

# This configuration will be changed to redirect to HTTPS later
server {
  server_name               backend.globeofarticles.com;
  listen                    443 ssl;
  ssl_certificate           /etc/letsencrypt/live/backend.globeofarticles.com/fullchain.pem;
  ssl_certificate_key       /etc/letsencrypt/live/backend.globeofarticles.com/privkey.pem;
  location / {
    proxy_pass              http://127.0.0.1:8000;
    proxy_set_header        Host $host;
  }
}

排查与解决方案 #

1. 补全HTTP到HTTPS的跳转规则 #

当前配置仅监听443端口的HTTPS请求，未处理80端口的HTTP请求，若浏览器或Cloudflare发起HTTP请求，会触发默认跳转逻辑形成循环。添加以下配置到ArticleWebsite文件中：

server {
  server_name backend.globeofarticles.com;
  listen 80;
  # 永久重定向HTTP到HTTPS
  return 301 https://$host$request_uri;
}

2. 检查后端服务的HTTPS强制跳转 #

如果127.0.0.1:8000的后端服务存在强制跳转HTTPS的配置，会因为不知道自身处于反向代理之后，重复触发跳转。需在Nginx的proxy配置中添加头部信息，告知后端服务当前请求的协议：

location / {
  proxy_pass              http://127.0.0.1:8000;
  proxy_set_header        Host $host;
  # 添加以下两行
  proxy_set_header        X-Forwarded-Proto $scheme;
  proxy_set_header        X-Forwarded-For $remote_addr;
}

同时修改后端服务配置，信任X-Forwarded-Proto头部，不再强制跳转。

3. 核对Cloudflare的SSL设置 #

• 进入Cloudflare控制台，找到backend.globeofarticles.com的SSL/TLS模式，建议设置为严格，确保Cloudflare与VPS之间全程用HTTPS通信
• 检查该子域名的页面规则，确认没有额外的强制跳转规则与Nginx配置冲突

4. 验证配置 #

修改完成后执行以下命令重载Nginx：

sudo nginx -s reload

用curl命令查看跳转链，确认问题是否解决：

curl -v https://backend.globeofarticles.com

同时查看Nginx访问日志分析请求状态：

tail -f /var/log/nginx/ArticleWebsite.access.log

内容的提问来源于stack exchange，提问作者Ghazi