Merge branch 'jacobvosmaer-gitlab/gitlab-ce-strict-host-headers'

CHANGELOG

@@ -92,6 +92,10 @@ v 8.9.6
   - Fix log statements in import/export. !5129
   - Fix commit avatar alignment in compare view. !5128
   - Fix broken migration in MySQL. !5005
+  - Overwrite Host and X-Forwarded-Host headers in NGINX !5213
+
+v 8.9.6 (unreleased)
+  - Fix importing of events under notes for GitLab projects
 
 v 8.9.5
   - Add more debug info to import/export and memory killer. !5108

lib/support/nginx/gitlab

@@ -49,7 +49,12 @@ server {
 
     proxy_http_version 1.1;
 
-    proxy_set_header    Host                $http_host;
+    ## By overwriting Host and clearing X-Forwarded-Host we ensure that
+    ## internal HTTP redirects generated by GitLab always send users to
+    ## YOUR_SERVER_FQDN.
+    proxy_set_header    Host                YOUR_SERVER_FQDN;
+    proxy_set_header    X-Forwarded-Host    "";
+
     proxy_set_header    X-Real-IP           $remote_addr;
     proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
     proxy_set_header    X-Forwarded-Proto   $scheme;

lib/support/nginx/gitlab-ssl

@@ -93,7 +93,12 @@ server {
 
     proxy_http_version 1.1;
 
-    proxy_set_header    Host                $http_host;
+    ## By overwriting Host and clearing X-Forwarded-Host we ensure that
+    ## internal HTTP redirects generated by GitLab always send users to
+    ## YOUR_SERVER_FQDN.
+    proxy_set_header    Host                YOUR_SERVER_FQDN;
+    proxy_set_header    X-Forwarded-Host    "";
+
     proxy_set_header    X-Real-IP           $remote_addr;
     proxy_set_header    X-Forwarded-Ssl     on;
     proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;