Module ngx_http_proxy_module

This directive appeared in version 0.8.22. Makes outgoing connections to a proxied server originate from the specified local IP address with an optional port (1.11.2). Parameter value can contain variables (1.3.12). The special value off (1.3.12) cancels the effect of the proxy_bind directive inherited from the previous configuration level, which allows the system to auto-assign the local IP address and port. The transparent parameter (1.11.0) allows outgoing connections to a proxied server originate from a non-local IP address, for example, from a real IP address of a client: proxy_bind $remote_addr transparent; In order for this parameter to work, it is usually necessary to run nginx worker processes with the superuser privileges. On Linux it is not required (1.13.8) as if the transparent parameter is specified, worker processes inherit the CAP_NET_RAW capability from the master process. It is also necessary to configure kernel routing table to intercept network traffic from the proxied server. Syntax: proxy_buffer_size size ;
Sets the size of the buffer used for reading the first part of the response received from the proxied server. This part usually contains a small response header. By default, the buffer size is equal to one memory page. This is either 4K or 8K, depending on a platform. It can be made smaller, however. Syntax: proxy_buffering on | off ;
Enables or disables buffering of responses from the proxied server. When buffering is enabled, nginx receives a response from the proxied server as soon as possible, saving it into the buffers set by the proxy_buffer_size and proxy_buffers directives. If the whole response does not fit into memory, a part of it can be saved to a temporary file on the disk. Writing to temporary files is controlled by the proxy_max_temp_file_size and proxy_temp_file_write_size directives. When buffering is disabled, the response is passed to a client synchronously, immediately as it is received. nginx will not try to read the whole response from the proxied server. The maximum size of the data that nginx can receive from the server at a time is set by the proxy_buffer_size directive. Buffering can also be enabled or disabled by passing “ yes ” or “ no ” in the “X-Accel-Buffering” response header field. This capability can be disabled using the proxy_ignore_headers directive. Syntax: proxy_buffers number size ;
Sets the number and size of the buffers used for reading a response from the proxied server, for a single connection. By default, the buffer size is equal to one memory page. This is either 4K or 8K, depending on a platform. Syntax: proxy_busy_buffers_size size ;
When buffering of responses from the proxied server is enabled, limits the total size of buffers that can be busy sending a response to the client while the response is not yet fully read. In the meantime, the rest of the buffers can be used for reading the response and, if needed, buffering part of the response to a temporary file. By default, size is limited by the size of two buffers set by the proxy_buffer_size and proxy_buffers directives. Syntax: proxy_cache zone | off ;
Defines a shared memory zone used for caching. The same zone can be used in several places. Parameter value can contain variables (1.7.9). The off parameter disables caching inherited from the previous configuration level. Syntax: proxy_cache_background_update on | off ;
Allows starting a background subrequest to update an expired cache item, while a stale cached response is returned to the client. Note that it is necessary to allow the usage of a stale cached response when it is being updated. Syntax: proxy_cache_bypass string ...;
Defines conditions under which the response will not be taken from a cache. If at least one value of the string parameters is not empty and is not equal to “0” then the response will not be taken from the cache: proxy_cache_bypass $cookie_nocache $arg_nocache$arg_comment; proxy_cache_bypass $http_pragma $http_authorization; Can be used along with the proxy_no_cache directive. Syntax: proxy_cache_convert_head on | off ;

This directive appeared in version 1.9.7. Enables or disables the conversion of the “ HEAD ” method to “ GET ” for caching. When the conversion is disabled, the cache key should be configured to include the $request_method . Syntax: proxy_cache_key string ;
proxy_cache_key "$host$request_uri $cookie_user"; By default, the directive’s value is close to the string proxy_cache_key $scheme$proxy_host$uri$is_args$args;

This directive appeared in version 1.1.12. When enabled, only one request at a time will be allowed to populate a new cache element identified according to the proxy_cache_key directive by passing a request to a proxied server. Other requests of the same cache element will either wait for a response to appear in the cache or the cache lock for this element to be released, up to the time set by the proxy_cache_lock_timeout directive. Syntax: proxy_cache_lock_age time ;

This directive appeared in version 1.7.8. If the last request passed to the proxied server for populating a new cache element has not completed for the specified time , one more request may be passed to the proxied server. Syntax: proxy_cache_lock_timeout time ;
Sets a timeout for proxy_cache_lock . When the time expires, the request will be passed to the proxied server, however, the response will not be cached. Before 1.7.8, the response could be cached.

This directive appeared in version 1.11.6. Sets an offset in bytes for byte-range requests. If the range is beyond the offset, the range request will be passed to the proxied server and the response will not be cached. Syntax: proxy_cache_methods GET | HEAD |

This directive appeared in version 0.7.59. If the client request method is listed in this directive then the response will be cached. “ GET ” and “ HEAD ” methods are always added to the list, though it is recommended to specify them explicitly. See also the proxy_no_cache directive. Syntax: proxy_cache_min_uses number ;
Sets the path and other parameters of a cache. Cache data are stored in files. The file name in a cache is a result of applying the MD5 function to the cache key . The levels parameter defines hierarchy levels of a cache: from 1 to 3, each level accepts values 1 or 2. For example, in the following configuration proxy_cache_path /data/nginx/cache levels=1:2 keys_zone=one:10m; file names in a cache will look like this: /data/nginx/cache/ c / 29 /b7f54b2df7773722d382f4809d650 29c A cached response is first written to a temporary file, and then the file is renamed. Starting from version 0.8.9, temporary files and the cache can be put on different file systems. However, be aware that in this case a file is copied across two file systems instead of the cheap renaming operation. It is thus recommended that for any given location both cache and a directory holding temporary files are put on the same file system. The directory for temporary files is set based on the use_temp_path parameter (1.7.10). If this parameter is omitted or set to the value on , the directory set by the proxy_temp_path directive for the given location will be used. If the value is set to off , temporary files will be put directly in the cache directory. In addition, all active keys and information about data are stored in a shared memory zone, whose name and size are configured by the keys_zone parameter. One megabyte zone can store about 8 thousand keys. As part of commercial subscription , the shared memory zone also stores extended cache information , thus, it is required to specify a larger zone size for the same number of keys. For example, one megabyte zone can store about 4 thousand keys. Cached data that are not accessed during the time specified by the inactive parameter get removed from the cache regardless of their freshness. By default, inactive is set to 10 minutes. The special “cache manager” process monitors the maximum cache size set by the max_size parameter, and the minimum amount of free space set by the min_free (1.19.1) parameter on the file system with cache. When the size is exceeded or there is not enough free space, it removes the least recently used data. The data is removed in iterations configured by manager_files , manager_threshold , and manager_sleep parameters (1.11.5). During one iteration no more than manager_files items are deleted (by default, 100). The duration of one iteration is limited by the manager_threshold parameter (by default, 200 milliseconds). Between iterations, a pause configured by the manager_sleep parameter (by default, 50 milliseconds) is made. A minute after the start the special “cache loader” process is activated. It loads information about previously cached data stored on file system into a cache zone. The loading is also done in iterations. During one iteration no more than loader_files items are loaded (by default, 100). Besides, the duration of one iteration is limited by the loader_threshold parameter (by default, 200 milliseconds). Between iterations, a pause configured by the loader_sleep parameter (by default, 50 milliseconds) is made. Additionally, the following parameters are available as part of our commercial subscription : Instructs whether cache entries that match a wildcard key will be removed from the disk by the cache purger (1.7.12). Setting the parameter to on (default is off ) will activate the “cache purger” process that permanently iterates through all cache entries and deletes the entries that match the wildcard key. purger_files = number Sets the number of items that will be scanned during one iteration (1.7.12). By default, purger_files is set to 10. purger_threshold = number Sets the duration of one iteration (1.7.12). By default, purger_threshold is set to 50 milliseconds. purger_sleep = number Sets a pause between iterations (1.7.12). By default, purger_sleep is set to 50 milliseconds. In versions 1.7.3, 1.7.7, and 1.11.10 cache header format has been changed. Previously cached responses will be considered invalid after upgrading to a newer nginx version.

This directive appeared in version 1.5.7. Defines conditions under which the request will be considered a cache purge request. If at least one value of the string parameters is not empty and is not equal to “0” then the cache entry with a corresponding cache key is removed. The result of successful operation is indicated by returning the 204 (No Content) response. If the cache key of a purge request ends with an asterisk (“ * ”), all cache entries matching the wildcard key will be removed from the cache. However, these entries will remain on the disk until they are deleted for either inactivity , or processed by the cache purger (1.7.12), or a client attempts to access them. Example configuration: proxy_cache_path /data/nginx/cache keys_zone=cache_zone:10m; map $request_method $purge_method { PURGE 1; default 0; server { location / { proxy_pass http://backend; proxy_cache cache_zone; proxy_cache_key $uri; proxy_cache_purge $purge_method; This functionality is available as part of our commercial subscription .

This directive appeared in version 1.5.7. Enables revalidation of expired cache items using conditional requests with the “If-Modified-Since” and “If-None-Match” header fields. Syntax: proxy_cache_use_stale error | timeout | invalid_header | updating | http_500 | http_502 | http_503 | http_504 | http_403 | http_404 | http_429 | Determines in which cases a stale cached response can be used during communication with the proxied server. The directive’s parameters match the parameters of the proxy_next_upstream directive. The error parameter also permits using a stale cached response if a proxied server to process a request cannot be selected. Additionally, the updating parameter permits using a stale cached response if it is currently being updated. This allows minimizing the number of accesses to proxied servers when updating cached data. Using a stale cached response can also be enabled directly in the response header for a specified number of seconds after the response became stale (1.11.10). This has lower priority than using the directive parameters. “ stale-while-revalidate ” extension of the “Cache-Control” header field permits using a stale cached response if it is currently being updated. “ stale-if-error ” extension of the “Cache-Control” header field permits using a stale cached response in case of an error. To minimize the number of accesses to proxied servers when populating a new cache element, the proxy_cache_lock directive can be used. Syntax: proxy_cache_valid [ code ...] time ;
proxy_cache_valid 404 1m; set 10 minutes of caching for responses with codes 200 and 302 and 1 minute for responses with code 404. If only caching time is specified proxy_cache_valid 5m; then only 200, 301, and 302 responses are cached. In addition, the any parameter can be specified to cache any responses: proxy_cache_valid 200 302 10m; proxy_cache_valid 301 1h; proxy_cache_valid any 1m; Parameters of caching can also be set directly in the response header. This has higher priority than setting of caching time using the directive. The “X-Accel-Expires” header field sets caching time of a response in seconds. The zero value disables caching for a response. If the value starts with the @ prefix, it sets an absolute time in seconds since Epoch, up to which the response may be cached. If the header does not include the “X-Accel-Expires” field, parameters of caching may be set in the header fields “Expires” or “Cache-Control”. If the header includes the “Set-Cookie” field, such a response will not be cached. If the header includes the “Vary” field with the special value “ * ”, such a response will not be cached (1.7.7). If the header includes the “Vary” field with another value, such a response will be cached taking into account the corresponding request header fields (1.7.7). Processing of one or more of these response header fields can be disabled using the proxy_ignore_headers directive. Syntax: proxy_connect_timeout time ;


This directive appeared in version 1.1.15. Sets a text that should be changed in the domain attribute of the “Set-Cookie” header fields of a proxied server response. Suppose a proxied server returned the “Set-Cookie” header field with the attribute “ domain=localhost ”. The directive proxy_cookie_domain localhost example.org; will rewrite this attribute to “ domain=example.org ”. A dot at the beginning of the domain and replacement strings and the domain attribute is ignored. Matching is case-insensitive. The domain and replacement strings can contain variables: proxy_cookie_domain www.$host $host; The directive can also be specified using regular expressions. In this case, domain should start from the “ ~ ” symbol. A regular expression can contain named and positional captures, and replacement can reference them: proxy_cookie_domain ~\.(?P<sl_domain>[-0-9a-z]+\.[a-z]+)$ $sl_domain; Several proxy_cookie_domain directives can be specified on the same level: proxy_cookie_domain localhost example.org; proxy_cookie_domain ~\.([a-z]+\.[a-z]+)$ $1; If several directives can be applied to the cookie, the first matching directive will be chosen. The off parameter cancels the effect of the proxy_cookie_domain directives inherited from the previous configuration level. Syntax: proxy_cookie_flags off | cookie [ flag ...];
Sets one or more flags for the cookie. The cookie can contain text, variables, and their combinations. The flag can contain text, variables, and their combinations (1.19.8). secure , httponly , samesite=strict , samesite=lax , samesite=none parameters add the corresponding flags. nosecure , nohttponly , nosamesite parameters remove the corresponding flags. The cookie can also be specified using regular expressions. In this case, cookie should start from the “ ~ ” symbol. Several proxy_cookie_flags directives can be specified on the same configuration level: proxy_cookie_flags one httponly; proxy_cookie_flags ~ nosecure samesite=strict; If several directives can be applied to the cookie, the first matching directive will be chosen. In the example, the httponly flag is added to the cookie one , for all other cookies the samesite=strict flag is added and the secure flag is deleted. The off parameter cancels the effect of the proxy_cookie_flags directives inherited from the previous configuration level. Syntax: proxy_cookie_path off ;
proxy_cookie_path path replacement ;
Sets a text that should be changed in the path attribute of the “Set-Cookie” header fields of a proxied server response. Suppose a proxied server returned the “Set-Cookie” header field with the attribute “ path=/two/some/uri/ ”. The directive proxy_cookie_path /two/ /; will rewrite this attribute to “ path=/some/uri/ ”. The path and replacement strings can contain variables: proxy_cookie_path $uri /some$uri; The directive can also be specified using regular expressions. In this case, path should either start from the “ ~ ” symbol for a case-sensitive matching, or from the “ ~* ” symbols for case-insensitive matching. The regular expression can contain named and positional captures, and replacement can reference them: proxy_cookie_path ~*^/user/([^/]+) /u/$1; Several proxy_cookie_path directives can be specified on the same level: proxy_cookie_path /one/ /; proxy_cookie_path / /two/; If several directives can be applied to the cookie, the first matching directive will be chosen. The off parameter cancels the effect of the proxy_cookie_path directives inherited from the previous configuration level. Syntax: proxy_force_ranges on | off ;
Sets the bucket size for hash tables used by the proxy_hide_header and proxy_set_header directives. The details of setting up hash tables are provided in a separate document . Syntax: proxy_headers_hash_max_size size ;
Sets the maximum size of hash tables used by the proxy_hide_header and proxy_set_header directives. The details of setting up hash tables are provided in a separate document . Syntax: proxy_hide_header field ;
nginx does not pass the header fields “Date”, “Server”, “X-Pad”, and “X-Accel-...” from the response of a proxied server to a client. The proxy_hide_header directive sets additional fields that will not be passed. If, on the contrary, the passing of fields needs to be permitted, the proxy_pass_header directive can be used. Syntax: proxy_http_version 1.0 | 1.1 ;
Sets the HTTP protocol version for proxying. By default, version 1.0 is used. Version 1.1 is recommended for use with keepalive connections and NTLM authentication . Syntax: proxy_ignore_client_abort on | off ;
Determines whether the connection with a proxied server should be closed when a client closes the connection without waiting for a response. Syntax: proxy_ignore_headers field ...;
Disables processing of certain response header fields from the proxied server. The following fields can be ignored: “X-Accel-Redirect”, “X-Accel-Expires”, “X-Accel-Limit-Rate” (1.1.6), “X-Accel-Buffering” (1.1.6), “X-Accel-Charset” (1.1.6), “Expires”, “Cache-Control”, “Set-Cookie” (0.8.44), and “Vary” (1.7.7). If not disabled, processing of these header fields has the following effect: “X-Accel-Expires”, “Expires”, “Cache-Control”, “Set-Cookie”, and “Vary” set the parameters of response caching ; “X-Accel-Redirect” performs an internal redirect to the specified URI; “X-Accel-Limit-Rate” sets the limit for transmission of a response to a client; “X-Accel-Buffering” enables or disables buffering of a response; “X-Accel-Charset” sets the desired charset of a response. Determines whether proxied responses with codes greater than or equal to 300 should be passed to a client or be intercepted and redirected to nginx for processing with the error_page directive. Syntax: proxy_limit_rate rate ;


This directive appeared in version 1.7.7. Limits the speed of reading the response from the proxied server. The rate is specified in bytes per second. The zero value disables rate limiting. The limit is set per a request, and so if nginx simultaneously opens two connections to the proxied server, the overall rate will be twice as much as the specified limit. The limitation works only if buffering of responses from the proxied server is enabled. Parameter value can contain variables (1.27.0). Syntax: proxy_max_temp_file_size size ;
When buffering of responses from the proxied server is enabled, and the whole response does not fit into the buffers set by the proxy_buffer_size and proxy_buffers directives, a part of the response can be saved to a temporary file. This directive sets the maximum size of the temporary file. The size of data written to the temporary file at a time is set by the proxy_temp_file_write_size directive. The zero value disables buffering of responses to temporary files. This restriction does not apply to responses that will be cached or stored on disk. Specifies the HTTP method to use in requests forwarded to the proxied server instead of the method from the client request. Parameter value can contain variables (1.11.6). Syntax: proxy_next_upstream error | timeout | invalid_header | http_500 | http_502 | http_503 | http_504 | http_403 | http_404 | http_429 | non_idempotent |