Nginx反向代理：如何改写303响应的Location头？

已配置好Nginx反向代理，可正常访问内部主机，但初次连接时服务器返回303响应引导客户端认证，Location头指向内部服务器地址，示例如下：

Status: 303 See Other
Location: http://kaonashi.local.abc.com/auth/login

如何改写该Location头，使其指向外部地址？当前Nginx配置如下：

server {
        listen 443 ssl; # Make sure the 'ssl' is added here as well

        ssl_certificate /etc/letsencrypt/live/external.abc.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/external.abc.com/privkey.pem;

        # modsecurity
        modsecurity on;
        modsecurity_rules_file /etc/nginx/modsec/main.conf;

        root /var/www/external.abc.com/html;
        index index.html index.htm index.nginx-debian.html;

        server_name external.abc.com;

        location / {
                try_files $uri $uri/ =404;
        }

        location /leantime/ {
                proxy_set_header Host kaonashi.local.abc.com;
                proxy_set_header X-Real-IP        $remote_addr;
                proxy_set_header X-Forwarded-For  $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Host $host:$server_port;
                proxy_set_header X-NginX-Proxy true;

                proxy_pass http://kaonashi.local.abc.com:8080/;
        }
}

要修改内部服务器返回的Location头，只需在/leantime/的location块中添加proxy_redirect指令，将内部地址替换为外部地址：

具体配置修改 #

在proxy_pass指令附近添加以下规则：

proxy_redirect http://kaonashi.local.abc.com/ https://external.abc.com/leantime/;

修改后的完整/leantime/ location块如下：

location /leantime/ {
        proxy_set_header Host kaonashi.local.abc.com;
        proxy_set_header X-Real-IP        $remote_addr;
        proxy_set_header X-Forwarded-For  $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $host:$server_port;
        proxy_set_header X-NginX-Proxy true;

        # 替换内部Location地址为外部地址
        proxy_redirect http://kaonashi.local.abc.com/ https://external.abc.com/leantime/;

        proxy_pass http://kaonashi.local.abc.com:8080/;
}

规则说明 #

• proxy_redirect专门用于修改上游服务器返回的响应头中Location和Refresh字段的内容
• 上述规则会把所有以http://kaonashi.local.abc.com/开头的Location值，替换为https://external.abc.com/leantime/
• 配置生效后，客户端收到的303响应中，Location头将变为https://external.abc.com/leantime/auth/login，符合外部访问的路径要求

内容的提问来源于stack exchange，提问作者baradhili