From 4853cd4238e100183fd7b0852ddf3e8eef894658 Mon Sep 17 00:00:00 2001
From: Junker der Provinz <jdp@halleluja.design>
Date: Fri, 23 Oct 2026 19:19:34 +0200
Subject: [PATCH] Remove `$server_port` from the Host header in the nginx
 reverse proxy example (#20391)

Fixes #19583

The nginx example in `docs/reverse_proxy.md` sets `proxy_set_header Host
$host:$server_port;`. The server block listens on 443, so nginx sends
`Host: matrix.example.com:443`. With `public_baseurl:
https://matrix.example.com/`, the request URI never starts with
`public_baseurl`, and `SsoRedirectServlet` keeps redirecting to itself.
That breaks SSO even when the internal and external ports are the same.
The line came in with #17994.

This switches the example to `proxy_set_header Host $host;`, as
@anoadragon453 recommended in #18359. I added a short comment for setups
where clients use a non-default port: use `$http_host` and put that port
in `public_baseurl`. The setup in #18359 (external port 50080) needs
that variant.

I left `docker/conf-workers/nginx.conf.j2` alone. Its listener port
matches `public_baseurl`, so `$host:$server_port` is right there.

This is a docs-only change, so there are no tests.

Thanks to @shibotto for reporting this and for pointing at the fix.

### Pull Request Checklist

<!-- Please read
https://element-hq.github.io/synapse/latest/development/contributing_guide.html
before submitting your pull request -->

* [x] Pull request is based on the develop branch
* [x] Pull request includes a [changelog
file](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#changelog).
The entry should:
- Be a short description of your change which makes sense to users.
"Fixed a bug that prevented receiving messages from other servers."
instead of "Moved X method from `EventStore` to `EventWorkerStore`.".
  - Use markdown where necessary, mostly for `code blocks`.
  - End with either a period (.) or an exclamation mark (!).
  - Start with a capital letter.
- Feel free to credit yourself, by adding a sentence "Contributed by
@github_username." or "Contributed by [Your Name]." to the end of the
entry.
* [x] [Code
style](https://element-hq.github.io/synapse/latest/code_style.html) is
correct (run the
[linters](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-linters))
---
 changelog.d/20391.doc | 1 +
 docs/reverse_proxy.md | 4 +++-
 2 files changed, 4 insertions(+), 1 deletion(-)
 create mode 100644 changelog.d/20391.doc

diff --git a/changelog.d/20391.doc b/changelog.d/20391.doc
new file mode 100644
index 0000000000..f47209ea33
--- /dev/null
+++ b/changelog.d/20391.doc
@@ -0,0 +1 @@
+Remove `$server_port` from the `Host` header in the nginx reverse proxy example, as it can cause an SSO redirect loop.
diff --git a/docs/reverse_proxy.md b/docs/reverse_proxy.md
index fc38c06335..26b96f34b2 100644
--- a/docs/reverse_proxy.md
+++ b/docs/reverse_proxy.md
@@ -76,7 +76,9 @@ server {
         proxy_pass http://localhost:8008;
         proxy_set_header X-Forwarded-For $remote_addr;
         proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header Host $host:$server_port;
+        # If clients reach Synapse on a non-default port, use `$http_host` instead
+        # so the port is kept, and include that port in `public_baseurl`.
+        proxy_set_header Host $host;
 
         # Nginx by default only allows file uploads up to 1M in size
         # Increase client_max_body_size to match max_upload_size defined in homeserver.yaml