Why does Flask’s ProxyFix return the Docker container name instead of the external host behind Nginx?

Below is an explanation of what’s happening and one approach to fixing the issue.

What’s Happening

Your current setup assigns the value of the variable $cors_origin to the header X-Forwarded-Host:

NGINXCopied
proxy_set_header X-Forwarded-Host $cors_origin;

If the if‑statement that sets $cors_origin isn’t triggered (or if it yields an empty string), then X‑Forwarded‑Host won’t have the correct host information. Flask’s ProxyFix picks up the host value from X‑Forwarded‑Host to rebuild URLs (used by functions like url_for). As a result, when $cors_origin remains empty or is not set as expected, ProxyFix falls back to using the docker container name (in this case, “api-service”).

Recommended Approach

Rather than relying on $cors_origin (which is primarily used for setting CORS response headers), you should send the actual request host to ProxyFix. In Nginx, the variable $host contains the incoming request’s host header. So, a more reliable header configuration would be:

NGINXCopied
proxy_set_header X-Forwarded-Host $host;

This ensures that your Flask application sees the external hostname (e.g. domain1.com) rather than the internal container name.

Updated Nginx Configuration Snippet

Below is the updated snippet of your location block emphasizing the change:

NGINXCopied
location /api/ {
    # Dynamically set the CORS origin based on the incoming request
    set $cors_origin "";
    if ($http_origin ~* (http://localhost:4025|https://domain1.com)) {
        set $cors_origin $http_origin;
    }
    
    # Add basic CORS headers for all requests
    add_header 'Access-Control-Allow-Origin' $cors_origin always;
    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
    add_header 'Access-Control-Allow-Headers' 'Accept, Content-Type, Authorization' always;
    
    # Handle CORS preflight (OPTIONS) requests
    if ($request_method = OPTIONS) {
        add_header 'Access-Control-Max-Age' 1728000;
        return 204;
    }
    
    # Handle other requests
    if ($request_method != OPTIONS) {
        add_header 'Access-Control-Allow-Credentials' 'true' always;
    }
    
    # Proxy to the API service
    proxy_pass http://api-service/;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    # Use the real host header from the incoming request
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Prefix /api;
    proxy_redirect off;
    proxy_connect_timeout 500s;
    proxy_send_timeout 500s;
    proxy_read_timeout 500s;
}

Flask Application Side

Your Flask configuration with ProxyFix remains unchanged:

PYTHONCopied
from werkzeug.middleware.proxy_fix import ProxyFix
from flask import Flask

app = Flask(__name__)
# Make sure ProxyFix has the proper parameters to trust one proxy in front.
app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_host=1, x_proto=1, x_prefix=1)

Verification

After making these changes, verify that the headers reaching your Flask app include the proper value for X‑Forwarded‑Host. You can do so by temporarily logging its value in one of your routes:

PYTHONCopied
from flask import request

@app.route('/debug-headers')
def debug_headers():
    return {
        'X-Forwarded-Host': request.headers.get('X-Forwarded-Host'),
        'X-Forwarded-Proto': request.headers.get('X-Forwarded-Proto'),
        'X-Forwarded-Prefix': request.headers.get('X-Forwarded-Prefix'),
    }

Verify that the output shows your external host (domain1.com) rather than “api-service”. With that correct header, ProxyFix will rebuild the URL, and your use of url_for(_external=True) will return the proper redirect_uri for Google OAuth.

This change should resolve the issue by ensuring that the right host is forwarded from Nginx to your Flask application.