# Managing Redirect when proxying a Web UI **URL:** \ **Category:** Questions\ **Created:** [December 8, 2017, 2:03pm UTC](https://discuss.konghq.com/t/managing-redirect-when-proxying-a-web-ui/164 "2017-12-08T14:03:00Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![pamiel](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/pamiel/32/153_2.png) [@pamiel](https://discuss.konghq.com/u/pamiel)\ **Post date:** [December 8, 2017, 2:03pm UTC](https://discuss.konghq.com/t/managing-redirect-when-proxying-a-web-ui/164/1 "2017-12-08T14:03:00Z")
Hi all, I would like to access to a UI server through Kong in order to perform some authentication and counts thanks to standard and custom plugins. The Web Browser is navigating the Web UI though Kong proxy API, using the url `http://kong:8000/ui`. Kong then proxies the calls to the upstream url `http://uiserver:8080` The issue I have is that the UI server performs several 302 Moved redirections: unfortunately, the Location header set by the UI server is using `http://uiserver:8080` as base URL, and this Location value does not make sense for the Web Browser as the Web Browser only knows the `http://kong:8000/ui` base URL. How can I configure Kong so that the Location URL is transformed into the “downstream representation”, and not the “upstream representation” ? Unfortunately I don’t have the capability to modify the UI Server to return a relative URL instead of a full one… Thanks for your help. ---
**Author:** ![pamiel](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/pamiel/32/153_2.png) [@pamiel](https://discuss.konghq.com/u/pamiel)\ **Post date:** [December 11, 2017, 1:51pm UTC](https://discuss.konghq.com/t/managing-redirect-when-proxying-a-web-ui/164/2 "2017-12-11T13:51:50Z")
Hi again, I’m partially answering to my own question: usage of the `preserve_host` attribute in the API declaration enables to keep the “external” Host (i.e. `uiserver` in my example above) in the Location redirect header, instead of the Kong host (`kong`). That’s already a good step !.. but, I now have an issue on the path ! To explain this, I need to go deeper into the explanations of my urls, sorry for that… Indeed if I take the plain UI Server, it is always using a common root path `/theUI` and all links and redirect URLs are under this `/theUI` path. I have no issue if I create a Kong API with the `uris` field set to `“/theUI”` and with `strip_uri` set to `false`… but I don’t want this because “theUI” keywork is a reserved keyword for my application: I cannot use it explicitly as root path for the UI server ☹ So I would like to declare an API in Kong with a `uris` field set to `“/ui”`, the UI Server being now accessible when I use `http://kong:8000/ui/theUI` (`strip_uri` set to `true`)… but then, the value of the Location Header of the response is not good: it is `http://kong:8000/theUI/xxx`: the host is managed properly… but not the path because I lost the `/ui/` due to the `strip_uri` being set to `true`, and then no way to navigate the redirected URI through Kong (Kong does not have API declared on `/theUI`; it is declared on `/ui`) ! What about setting `strip_uri` to `false`? This does not work because this time this is the very first request that will not route to my UI Server (because the upstream URI `http://uiserver:8080/theUI/ui` does not exist 😫 ) As a summary, it looks I would need a new `preserve_stripped_path` parameter that would add back in the Location header of the response the part of the URI that has been cut/stripped when processing the request! And maybe not only in the Location header; this is true also for all URLs that may have been returned as links of the UI’s html or php or… returned pages! It looks like the “reverse proxy pass” feature of an Apache server… And more than that, isn’t it the same issue if I have a REST endpoint (I’m no longer talking about a UI at all) that returns JSONs containing URLs of other resources: the resource server might consider the usage of the Host header for the domain name, but no way to consider the part of the path that has been cut by the “URI stripping mechanism” of Kong ! Only Kong can add back this cut/stripped part of the urls… Any idea to addess this issue on the path? ---
**Author:** ![thibaultcha](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/thibaultcha/32/340_2.png) [@thibaultcha](https://discuss.konghq.com/u/thibaultcha)\ **Post date:** [December 11, 2017, 10:34pm UTC](https://discuss.konghq.com/t/managing-redirect-when-proxying-a-web-ui/164/3 "2017-12-11T22:34:56Z")
Hi, Kong isn’t built to play well with UIs and redirects (in fact, I would advise against using Kong in front of a website). Maybe you could develop a plugin of your own that would handle the rewriting of those `Location` headers, and/or controlling what the upstream call’s URL looks like (bot of which are achievable with a custom plugin and minimum amount of work). You could maybe avoid having to do that with defining multiple APIs with different matching and stripping rules, but I haven’t taken a look myself (your requirements and issues are confusing to read in your message). ---
**Author:** ![pamiel](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/pamiel/32/153_2.png) [@pamiel](https://discuss.konghq.com/u/pamiel)\ **Post date:** [December 13, 2017, 9:55am UTC](https://discuss.konghq.com/t/managing-redirect-when-proxying-a-web-ui/164/4 "2017-12-13T09:55:03Z")
Hi @thibaultcha I’m a bit surprised by your statement “I would advise against using Kong in front of a website” : Kong Enterprise Edition includes an OpenID Connect plugin which role is definitely to protect a web site by providing OIDC authentication flows! I don’t understand what differs from one use case (Kong’s EE plugin protecting a web site) to the other (mine, just proxying a website)? ---
**Author:** ![hisham](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hisham/32/14_2.png) [@hisham](https://discuss.konghq.com/u/hisham)\ **Post date:** [December 13, 2017, 1:56pm UTC](https://discuss.konghq.com/t/managing-redirect-when-proxying-a-web-ui/164/5 "2017-12-13T13:56:13Z")
OpenID Connect can be used not only for websites. The [suite of OIDC plugins in Kong EE perform several specific roles](https://getkong.org/plugins/ee-openid-connect-rp/), but none of them include arbitrary web proxying. The Authentication plugin implements OIDC’s specific authentication flow only, and the Protection plugin is used to proxy APIs in an OIDC-authenticated manner. ---
**Author:** ![pamiel](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/pamiel/32/153_2.png) [@pamiel](https://discuss.konghq.com/u/pamiel)\ **Post date:** [December 14, 2017, 8:28am UTC](https://discuss.konghq.com/t/managing-redirect-when-proxying-a-web-ui/164/6 "2017-12-14T08:28:52Z")
Ok, fair, I was so concentrated on web UI management ! 😉 In addition to the `Location` header management, what would be missing up to you in Kong Core in order to proxy a web site (so to be implemented as a custom plugin) ? @thibaultcha, what do you mean exactly by “controlling what the upstream call’s URL looks like”? Thanks for your help ---
**Author:** ![thibaultcha](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/thibaultcha/32/340_2.png) [@thibaultcha](https://discuss.konghq.com/u/thibaultcha)\ **Post date:** [December 15, 2017, 5:33am UTC](https://discuss.konghq.com/t/managing-redirect-when-proxying-a-web-ui/164/7 "2017-12-15T05:33:41Z")
> @thibaultcha, what do you mean exactly by “controlling what the upstream call’s URL looks like”? I mean the URL of the request made by Kong to your upstream service. This value is configurable from plugins via the `ngx.var.upstream_uri` variable. ---
**Author:** ![julienlau](https://avatars.discourse-cdn.com/v4/letter/j/2bfe46/32.png) [@julienlau](https://discuss.konghq.com/u/julienlau)\ **Post date:** [September 28, 2018, 7:52am UTC](https://discuss.konghq.com/t/managing-redirect-when-proxying-a-web-ui/164/8 "2018-09-28T07:52:59Z")
Same issue on myside : I cannot manage to avoid Kong redirecting my web UI instead of reverse proxy it. @Pamiel did you manage to do it ? ---
**Author:** ![pamiel](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/pamiel/32/153_2.png) [@pamiel](https://discuss.konghq.com/u/pamiel)\ **Post date:** [September 28, 2018, 8:30am UTC](https://discuss.konghq.com/t/managing-redirect-when-proxying-a-web-ui/164/9 "2018-09-28T08:30:24Z")
Hi @julienlau, I’m not sure to understand your concern, sorry for that ! Could you please clarify the issue you have (you cannot “avoid” redirection ??) ? On my side, the issue was that when a redirection was sent (on purpose) by an upstream Web UI server, then the URL contained in the `Location` HTTP Header was containing an “internal” URL, and not a URL that could be navigated by the web browser. Indeed, as far as I remember, I solved my issue by using the `X-Forwarded-Host` header (and by setting the `trusted_ips` configuration parameter of Kong to enable the transmission of the `X-Forwarded-*` headers) and implementing correctly the Web UI upstream server: - All URLs generated in response (e.g. in the HTML or JS) should be relative. - Web UI server shall be accessible directly on “/” - In case an absolute URL is required (for example in the `Location`header), then the “host” part of this URL shall be taken from `X-Forwarded-Host` and not in the incoming URL. Does this make sense for your problem? ---
**Author:** ![julienlau](https://avatars.discourse-cdn.com/v4/letter/j/2bfe46/32.png) [@julienlau](https://discuss.konghq.com/u/julienlau)\ **Post date:** [September 28, 2018, 12:36pm UTC](https://discuss.konghq.com/t/managing-redirect-when-proxying-a-web-ui/164/10 "2018-09-28T12:36:27Z")
Hi pamiel, thank you for your quick answer. Your tip regarding serving on “/” helped me. I have a setup with a node running Kong to load balance API located in a VLAN (private network). Kong is also used to expose those API to the public. This is running OK. I wanted to use Kong to reverse proxy a web UI located in this VLAN in order to expose it to the public but using Kong for SSL and Auth. I have trouble with this. It seems to work when the web server in the private VLAN servers static html on “/”, but I cannot make it work otherwise. If on this static server on a Vlan I put an index.html in a subdir for example “nifi” I cannot reach it through Kong. More precisely this route won’t work: [http://mykong/myPrivateNifi](http://mykong/myPrivateNifi) but this route works: [http://mykong/myPrivateNifi/index.html](http://mykong/myPrivateNifi/index.html) This is a test but in the end the UI I want to serve is a war (nifi-web-ui-1.6.0.war from apache nifi). I think I’d better try to use custom nginx template to directly setup a reverse proxy. Thanks ---
**Author:** ![pamiel](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/pamiel/32/153_2.png) [@pamiel](https://discuss.konghq.com/u/pamiel)\ **Post date:** [September 28, 2018, 1:11pm UTC](https://discuss.konghq.com/t/managing-redirect-when-proxying-a-web-ui/164/11 "2018-09-28T13:11:45Z")
Isn’t it linked to a missing ending slash for your first URI ? Web servers might interpret differently [http://mykong/myPrivateNifi](http://mykong/myPrivateNifi) (without ending slash) and [http://mykong/myPrivateNifi/](http://mykong/myPrivateNifi/) (with a ending slash): in first case, it is a file named `myPrivateNifi` within the `myKong` directory (this file does not exist!) while in the second one, it is the `myPrivateNifi` leaf directory, which is often processed by web server using the following rules: “if URL targets a directory, then try to get the `index.html` (or `index.php` or…) file located inside this directory”. Can you try again with this ending slash (I don’t remember how Kong reacts to such ending slashes…)? ---
**Author:** ![julienlau](https://avatars.discourse-cdn.com/v4/letter/j/2bfe46/32.png) [@julienlau](https://discuss.konghq.com/u/julienlau)\ **Post date:** [September 28, 2018, 2:15pm UTC](https://discuss.konghq.com/t/managing-redirect-when-proxying-a-web-ui/164/12 "2018-09-28T14:15:02Z")
Thanks for the help. I tried adding the trailing slash on the Kong service side and it has no effect. However adding the trailing slash on client side helps. However, I also needed to adapt the service so as to remove the strip\_path option on the route so that it works for my nifi war web UI. See configuration on images enclosed. Host myKong has a public IP and a private Ip 192.168.1.2 Host 192.168.1.3 is only on private network. ![kong-services](https://canada1.discourse-cdn.com/flex036/uploads/konghq/original/1X/3bfb342a6a41271b80d5c79c2e5566988125ceda.png) ![kong-routes](https://canada1.discourse-cdn.com/flex036/uploads/konghq/original/1X/1a518797a7273bccd85c9ef4f087d2a2c4ddeada.png) And requests below: curl -i myKong:8080/myPrivateHtml -\> OK curl -i myKong:8080/myPrivateHtmlSubdir -\> KO curl -i myKong:8080/myPrivateHtmlSubdir/ -\> OK curl -i myKong:8080/myPrivateHtmlSubdirTrailingSlash -\> KO curl -i myKong:8080/myPrivateHtmlSubdirTrailingSlash/ -\> OK curl -i myKong:8080/nifi-test -\> KO (302) curl -i myKong:8080/nifi-test/ -\> KO: HTTP is 200, but the war fails to found some dependency due to path Example : Request URL: [http://mykong:8080/nifi-docs/html/expression-language-guide.html](http://mykong:8080/nifi-docs/html/expression-language-guide.html) Request Method: GET Status 404… curl -i myKong:8080/nifi -\> KO (302) curl -i myKong:8080/nifi/ -\> OK Too bad I cannot tweak the strip\_path to work correctly because, I would like to address multiples nodes running this nifi web UI on my Vlan. ---
**Author:** ![Tieske](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/tieske/32/54_2.png) [@Tieske](https://discuss.konghq.com/u/Tieske)\ **Post date:** [October 4, 2018, 6:00pm UTC](https://discuss.konghq.com/t/managing-redirect-when-proxying-a-web-ui/164/13 "2018-10-04T18:00:40Z")
fyi, this PR was just merged and changes the way the paths are build: [https://github.com/Kong/kong/pull/3780](https://github.com/Kong/kong/pull/3780) this might be of interest. ---
**Author:** ![kailashvermaa](https://avatars.discourse-cdn.com/v4/letter/k/f6c823/32.png) [@kailashvermaa](https://discuss.konghq.com/u/kailashvermaa)\ **Post date:** [April 7, 2020, 8:35am UTC](https://discuss.konghq.com/t/managing-redirect-when-proxying-a-web-ui/164/14 "2020-04-07T08:35:59Z")
Hi, I am also trying to make my UI application publicly available via Kong, but getting issue while authentication, as its redirection URL is different from the downstream URL. Its forwarding its upstream URL instead of actual URL for authentication. Can anyone help configuring X-Forwarder-Host ? How I can configure it in my kong.conf My existing kong.cong plugins = custom\_plugins trusted\_ips = x.x.x.x/x real\_ip\_header = X-Forwarded-For read\_ip\_recursive = on @pamiel @julienlau ---
**Author:** ![abdul.razak](https://avatars.discourse-cdn.com/v4/letter/a/f14d63/32.png) [@abdul.razak](https://discuss.konghq.com/u/abdul.razak)\ **Post date:** [December 2, 2021, 7:51am UTC](https://discuss.konghq.com/t/managing-redirect-when-proxying-a-web-ui/164/15 "2021-12-02T07:51:03Z")
@pamiel @kailashvermaa got any solution for this ? , is there any way to preserve kong domain on address bar ?.. Its actually redirecting to my upstream web application