X-Accel-Redirect feature does not work for external connections (inside docker network)

Question

I'm trying to allow container with django to manage access to media files served from another container with nginx. Because of that despite of nginx documentation, I've removed the internal line from the location config:

server {
    server_name nginx; //name of the container used for accessing from another containers
    charset UTF-8;
    client_max_body_size 32m;
    listen 80;

    location /protected/media/ {
        // internal;
        alias /data/djan,go/media/;
    }
}

With this config I'm able to use /protected/media urls from django containers so I've succeeded at doing wget http://nginx/protected/media/images/bank_credentials/H0grsrvgsBo.jpg from shell of container with django.

But django's code

response = HttpResponse()
del response['Content-Type']
response['X-Accel-Redirect'] = 'http://nginx/protected/media/' + path # I'm sure that this url matches to url I've used succesfully with wget
return response

returning 404 Here is the django's url:

path('media/<path:path>', media_access, name='media')

Where I'm wrong?

Did you check the URL directly with Django without Nginx inbetween? — Bernhard Vallant, Mar 11 '19 at 09:32
do you really mean a comma here `alias /data/djan,go/media/;` ? — Yugandhar Chaudhari, Mar 12 '19 at 11:57

score 1 · Accepted Answer · answered Mar 12 '19 at 22:19

It sounds like what you're trying to do is have X-Accel-Redirect with an absolute URL for an external domain/host, hence the need to remove internal as per http://nginx.org/r/internal to make the files accessible without authentication. It doesn't work like that.

Take a look at the examples provided at http://nginx.org/r/proxy_pass_request_headers, for example:

location /x-accel-redirect-here/ {
    proxy_method GET;
    proxy_pass_request_headers off;
    proxy_pass_request_body off;

    proxy_pass ...
}

It'd be totally reasonable for nginx to have a requirements of having to use relative URLs in X-Accel-Redirect; otherwise, how would nginx know how exactly to handle the request?

In other words, you probably would have to use relative URLs in X-Accel-Redirect, and, if you require escaping into another container, to have extra internal location directives to do an explicit proxy_pass, as appropriate.

Note that doing this might invalidate the whole benefit of using X-Accel-Redirect in the first place, especially due to http://nginx.org/r/proxy_buffering being on by default, which causes nginx to save each proxied file onto disc, hence disc throughput may quickly become the limiting factor in your setup.

X-Accel-Redirect feature does not work for external connections (inside docker network)

1 Answers1