how to stop nginx setting http connection header to close? - http

Question

I have Spring Security servers running behind an nginx proxy. Currently I am having an issue with nginx setting http header Connection: close, as a result tomcat socket connections are closed too early.
NGINX configuration file
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;
events {
worker_connections 1024;
}
http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 4096;
include /etc/nginx/mime.types;
default_type application/octet-stream;
# Load modular configuration files from the /etc/nginx/conf.d directory.
# See http://nginx.org/en/docs/ngx_core_module.html#include
# for more information.
include /etc/nginx/conf.d/*.conf;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_certificate /etc/nginx/cert.crt;
ssl_certificate_key /etc/nginx/cert.key;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name _;
root /data/www;
absolute_redirect off;
location / {
index index.html index.php;
proxy_set_header Referer "";
}
location /authenticate {
proxy_http_version 1.1;
proxy_pass http://127.0.0.1:8080/authenticate;
proxy_redirect http://auth-server:9000/ https://111.111.11.111:22222/;
proxy_redirect http://127.0.0.1:8080/ https://111.111.11.111:22222/;
}
location /oauth2/authenticate {
proxy_http_version 1.1;
proxy_pass http://127.0.0.1:8080//oauth2/authenticate;
proxy_redirect http://auth-server:9000/ https://111.111.11.111:22222/;
}
...
Spring Security Client server logs (below) have the following lines that show
Socket status is set to "Status in: [OPEN_READ], State out: [CLOSED] "
HTTP header has Connection: close (I expect this set to keep-alive by default but it is not)
Requested session id is invalid.
2022-07-07 15:00:17.596 DEBUG 11690 --- [nio-8080-exec-8] o.s.s.web.DefaultRedirectStrategy : Redirecting to http://auth-server:9000/oauth2/authorize?response_type=code&client_id=client&scope=openid&state=giGRLf_DyH5GziZfHvjWlVlMo-cDELAX6E5sfLJkPM8%3D&redirect_uri=http://127.0.0.1:8080/login/oauth2/code/client-oidc&nonce=2GNlYXwjZS2bqoZ-73kSkqc_TFu_eImnH05iEsxO2UE
2022-07-07 15:00:17.596 DEBUG 11690 --- [nio-8080-exec-8] w.c.HttpSessionSecurityContextRepository : Did not store empty SecurityContext
2022-07-07 15:00:17.596 DEBUG 11690 --- [nio-8080-exec-8] w.c.HttpSessionSecurityContextRepository : Did not store empty SecurityContext
2022-07-07 15:00:17.596 DEBUG 11690 --- [nio-8080-exec-8] s.s.w.c.SecurityContextPersistenceFilter : Cleared SecurityContextHolder to complete request
2022-07-07 15:00:17.596 DEBUG 11690 --- [nio-8080-exec-8] o.apache.coyote.http11.Http11Processor : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper#278d5e31:org.apache.tomcat.util.net.NioChannel#2be48f79:java.nio.channels.SocketChannel[connected local=/127.0.0.1:8080 remote=/192.111.111.222:55200]], Status in: [OPEN_READ], State out: [CLOSED]
2022-07-07 15:00:17.596 DEBUG 11690 --- [nio-8080-exec-8] o.apache.tomcat.util.threads.LimitLatch : Counting down[http-nio-8080-exec-8] latch=1
2022-07-07 15:00:17.596 DEBUG 11690 --- [nio-8080-exec-8] org.apache.tomcat.util.net.NioEndpoint : Calling [org.apache.tomcat.util.net.NioEndpoint#64e25661].closeSocket([org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper#278d5e31:org.apache.tomcat.util.net.NioChannel#2be48f79:java.nio.channels.SocketChannel[connected local=/127.0.0.1:8080 remote=/192.111.111.222:55200]])
2022-07-07 15:01:02.647 DEBUG 11690 --- [o-8080-Acceptor] o.apache.tomcat.util.threads.LimitLatch : Counting up[http-nio-8080-Acceptor] latch=1
2022-07-07 15:01:02.648 DEBUG 11690 --- [nio-8080-exec-9] o.a.coyote.http11.Http11InputBuffer : Before fill(): parsingHeader: [true], parsingRequestLine: [true], parsingRequestLinePhase: [0], parsingRequestLineStart: [0], byteBuffer.position(): [0], byteBuffer.limit(): [0], end: [629]
2022-07-07 15:01:02.648 DEBUG 11690 --- [nio-8080-exec-9] o.a.tomcat.util.net.SocketWrapperBase : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper#462a89b9:org.apache.tomcat.util.net.NioChannel#2be48f79:java.nio.channels.SocketChannel[connected local=/127.0.0.1:8080 remote=/192.111.111.222:55200]], Read from buffer: [0]
2022-07-07 15:01:02.648 DEBUG 11690 --- [nio-8080-exec-9] org.apache.tomcat.util.net.NioEndpoint : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper#462a89b9:org.apache.tomcat.util.net.NioChannel#2be48f79:java.nio.channels.SocketChannel[connected local=/127.0.0.1:8080 remote=/192.111.111.222:55200]], Read direct from socket: [556]
2022-07-07 15:01:02.648 DEBUG 11690 --- [nio-8080-exec-9] o.a.coyote.http11.Http11InputBuffer : Received [GET /authenticate HTTP/1.1
Host: 127.0.0.1:8080
Connection: close
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cookie: JSESSIONID=CBE7BC7B1ABAC7F69908F6D0536A32CE
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Pragma: no-cache
Cache-Control: no-cache
]
2022-07-07 15:01:02.648 DEBUG 11690 --- [nio-8080-exec-9] o.a.t.util.http.Rfc6265CookieProcessor : Cookies: Parsing b[]: JSESSIONID=CBE7BC7B1ABAC7F69908F6D0536A32CE
2022-07-07 15:01:02.648 DEBUG 11690 --- [nio-8080-exec-9] o.a.catalina.connector.CoyoteAdapter : Requested cookie session id is CBE7BC7B1ABAC7F69908F6D0536A32CE
2022-07-07 15:01:02.648 DEBUG 11690 --- [nio-8080-exec-9] o.a.c.authenticator.AuthenticatorBase : Security checking request GET /authenticate
2022-07-07 15:01:02.648 DEBUG 11690 --- [nio-8080-exec-9] org.apache.catalina.realm.RealmBase : No applicable constraints defined
2022-07-07 15:01:02.648 DEBUG 11690 --- [nio-8080-exec-9] o.a.c.authenticator.AuthenticatorBase : Not subject to any constraint
2022-07-07 15:01:02.649 DEBUG 11690 --- [nio-8080-exec-9] o.s.security.web.FilterChainProxy : Securing GET /authenticate
2022-07-07 15:01:02.649 DEBUG 11690 --- [nio-8080-exec-9] s.s.w.c.SecurityContextPersistenceFilter : Set SecurityContextHolder to empty SecurityContext
2022-07-07 15:01:02.649 DEBUG 11690 --- [nio-8080-exec-9] o.s.s.w.a.AnonymousAuthenticationFilter : Set SecurityContextHolder to anonymous SecurityContext
2022-07-07 15:01:02.649 DEBUG 11690 --- [nio-8080-exec-9] org.apache.tomcat.util.http.Parameters : Set encoding to UTF-8
2022-07-07 15:01:02.649 DEBUG 11690 --- [nio-8080-exec-9] o.s.s.w.session.SessionManagementFilter : Request requested invalid session id CBE7BC7B1ABAC7F69908F6D0536A32CE
2022-07-07 15:01:02.649 DEBUG 11690 --- [nio-8080-exec-9] o.s.s.w.a.i.FilterSecurityInterceptor : Failed to authorize filter invocation [GET /authenticate] with attributes [authenticated]
2022-07-07 15:01:02.650 DEBUG 11690 --- [nio-8080-exec-9] o.s.s.w.s.HttpSessionRequestCache
...
I suspect the socket connection is closed due to Connection being set to close in the http request header. Is it expected behaviour for nginx to set Connection header to close? How can I control this?
Many thanks