Nginx临时重定向与永久重定向的区别及配置指南

https://example.com/blog/old-post

https://example.com/blog/new-post

server {
    listen 80;
    server_name example.com;
    location = /blog/old-post {
        return 301 https://example.com/blog/new-post;
    }
}

location = /blog/old-post {
    return 302 https://example.com/blog/new-post;
}

server {
    listen 80;
    server_name old-domain.com www.old-domain.com;
    location / {
        return 301 https://new-domain.com$request_uri;
    }
}

server {
    listen 80;
    server_name maintenance.example.com;
    location / {
        return 302 https://status.example.com/maintenance;
    }
}

server {
    listen 80;
    server_name example.com;
    # 将 /product/123 重定向到 /item/123
    rewrite ^/product/(\d+)$ https://example.com/item/$1 permanent;
}

server {
    listen 80;
    server_name example.com;
    # 临时重定向旧版 API
    rewrite ^/api/v1/(.*)$ https://api.example.com/v2/$1 redirect;
}

server {
    listen 80;
    server_name example.com;
    if ($http_user_agent ~* "(Android|iPhone|iPad|iPod)") {
        return 301 https://m.example.com$request_uri;
    }
    # 桌面用户保持原址
    root /var/www/html;
    index index.html;
}

server {
    listen 80;
    server_name example.com;
    # 10% 用户被临时引导到新首页
    if ($http_cookie ~* "ab_test_group=group_b") {
        return 302 https://new-homepage.example.com/;
    }
    # 默认访问旧首页
    root /var/www/html/old;
}

map $host $redirect_target {
    default           https://main-site.com$request_uri;
    old-site.com      https://new-site.com$request_uri;
    legacy-site.org   https://archive.new-site.com$request_uri;
}
server {
    listen 80;
    server_name old-site.com legacy-site.org;
    return 301 $redirect_target;
}

geo $geo_country {
    default US;
    192.168.1.0/24 CN;
    10.0.0.0/8 JP;
}
map $geo_country $temp_redirect {
    default "";
    CN https://cn.example.com/;
    JP https://jp.example.com/;
}
server {
    listen 80;
    server_name example.com;
    if ($temp_redirect) {
        return 302 $temp_redirect;
    }
    root /var/www/html;
}

server {
    listen 80;
    server_name example.com www.example.com;
    # 所有 HTTP 请求永久跳转到 HTTPS
    return 301 https://$host$request_uri;
}
server {
    listen 443 ssl;
    server_name example.com www.example.com;
    ssl_certificate /etc/ssl/certs/fullchain.pem;
    ssl_certificate_key /etc/ssl/private/privkey.pem;
    root /var/www/html;
    index index.html;
}

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

server {
    listen 80;
    server_name spa.example.com;
    root /var/www/spa;
    index index.html;
    location / {
        try_files $uri $uri/ /index.html;
    }
}

server {
    listen 80;
    server_name app.example.com;
    location / {
        # 检查是否携带登录态 Cookie
        if ($http_cookie !~* "auth_token=") {
            set $redirect_url "https://auth.example.com/login?return_url=$scheme://$host$request_uri";
            return 302 $redirect_url;
        }
        proxy_pass http://java-backend:8080;
        proxy_set_header Host $host;
    }
}

@RestController
public class AuthController {
    @GetMapping("/login")
    public String loginPage(HttpServletRequest request, Model model) {
        String returnUrl = request.getParameter("return_url");
        if (returnUrl != null && returnUrl.startsWith("https://app.example.com")) {
            model.addAttribute("returnUrl", returnUrl);
        }
        return "login"; // 返回登录页面模板
    }
    @PostMapping("/do-login")
    public ResponseEntity<?> doLogin(
            @RequestParam String username,
            @RequestParam String password,
            HttpServletRequest request,
            HttpServletResponse response) {
        // 验证用户名密码（省略）
        boolean authenticated = authenticate(username, password);
        if (authenticated) {
            // 设置登录态 Cookie
            Cookie authCookie = new Cookie("auth_token", UUID.randomUUID().toString());
            authCookie.setPath("/");
            authCookie.setMaxAge(3600);
            authCookie.setHttpOnly(true);
            authCookie.setSecure(true); // HTTPS only
            response.addCookie(authCookie);
            // 获取原始请求地址，重定向回去
            String returnUrl = request.getParameter("return_url");
            if (returnUrl != null && isValidRedirectUrl(returnUrl)) {
                return ResponseEntity.status(HttpStatus.FOUND)
                        .location(URI.create(returnUrl))
                        .build();
            } else {
                // 默认跳转首页
                return ResponseEntity.redirect(URI.create("https://app.example.com/dashboard")).build();
            }
        }
        return ResponseEntity.badRequest().body("Invalid credentials");
    }
    private boolean isValidRedirectUrl(String url) {
        // 白名单校验，防止开放重定向漏洞
        return url.startsWith("https://app.example.com/") &&
               !url.contains("..") &&
               !url.contains("//");
    }
}

server {
    listen 80;
    server_name example.com;
    return 301 https://example.com$request_uri; # 👈 问题：自身重定向
}

server {
    listen 80;
    server_name example.com;
    return 301 https://$host$request_uri; # $host 是原域名，安全
}
server {
    listen 443 ssl;
    server_name example.com;
    # 正常处理 HTTPS 请求
}

location / {
    return 302 https://new-domain.com$request_uri;
}

return 301 https://new-site.com;

return 301 https://new-site.com$request_uri;

location ~ ^/old/(.*)$ {
    rewrite ^(.*)$ /new/$1 permanent; # ❌ 冗余且易错
}

location ~ ^/old/(.*)$ {
    return 301 /new/$1;
}

return 301 http://example.com$request_uri; # ❌ 在 HTTPS 服务器中跳回 HTTP

return 301 https://$host$request_uri;

import org.apache.http.HttpResponse;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.util.EntityUtils;
import java.io.IOException;
public class RedirectTest {
    public static void main(String[] args) throws IOException {
        CloseableHttpClient client = HttpClients.createDefault();
        HttpGet get = new HttpGet("http://old-domain.com/product/123");
        // 设置不自动跳转，以便观察原始响应
        HttpResponse response = client.execute(get);
        System.out.println("Status Code: " + response.getStatusLine().getStatusCode());
        System.out.println("Location Header: " + response.getFirstHeader("Location") != null ?
                response.getFirstHeader("Location").getValue() : "null");
        // 如果是 301 或 302，手动获取 Location 并再次请求
        if (response.getStatusLine().getStatusCode() == 301 || response.getStatusLine().getStatusCode() == 302) {
            String newUrl = response.getFirstHeader("Location").getValue();
            System.out.println("Redirecting to: " + newUrl);
            HttpGet secondGet = new HttpGet(newUrl);
            HttpResponse secondResponse = client.execute(secondGet);
            System.out.println("Final Status: " + secondResponse.getStatusLine().getStatusCode());
        }
        EntityUtils.consume(response.getEntity());
        client.close();
    }
}

Status Code: 301
Location Header: https://new-domain.com/product/123
Redirecting to: https://new-domain.com/product/123
Final Status: 200

@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
@AutoConfigureTestHttpClient
class RedirectIntegrationTest {
    @Test
    void testOldUrlRedirectsToNewUrlWith301() {
        ResponseEntity<String> response = restTemplate.getForEntity(
                "http://localhost:8080/old-page", String.class);
        assertThat(response.getStatusCode()).isEqualTo(HttpStatus.MOVED_PERMANENTLY);
        assertThat(response.getHeaders().getLocation().getPath())
                .isEqualTo("/new-page");
    }
    @Test
    void testTemporaryRedirectPreservesOriginalUrl() {
        ResponseEntity<Void> response = restTemplate.getForEntity(
                "http://localhost:8080/maintenance", Void.class);
        assertThat(response.getStatusCode()).isEqualTo(HttpStatus.FOUND);
        assertThat(response.getHeaders().getLocation().toString())
                .contains("https://status.example.com");
    }
}

map $http_accept_language $lang {
    default en;
    ~*^zh en;
    ~*^ja ja;
    ~*^ko ko;
}
server {
    listen 80;
    server_name example.com;
    location / {
        if ($lang != "en") {
            return 301 https://$lang.example.com$request_uri;
        }
        root /var/www/en;
    }
}

https://your-site.com/login?return_url=https://phishing-site.com

private boolean isValidRedirectUrl(String url) {
    if (url == null) return false;
    URI uri;
    try {
        uri = new URI(url);
    } catch (URISyntaxException e) {
        return false;
    }
    return "https".equals(uri.getScheme()) &&
           ("app.example.com".equals(uri.getHost()) ||
            "api.example.com".equals(uri.getHost())) &&
           !uri.getPath().contains("..") &&
           !uri.getPath().startsWith("//");
}

if ($http_host !~* ^(example\.com|www\.example\.com)$ ) {
    return 403;
}

proxy_set_header X-Forwarded-Host $host;

log_format redirect_log '$remote_addr - $remote_user [$time_local] '
                        '"$request" $status $body_bytes_sent '
                        '"$http_referer" "$http_user_agent" '
                        'redirect_to="$upstream_http_location" '
                        'redirect_type=$sent_http_location';
access_log /var/log/nginx/redirect.log redirect_log;

# 统计 301 重定向次数
grep '301' /var/log/nginx/redirect.log | wc -l

# 查看跳转目标分布
grep '301' /var/log/nginx/redirect.log | awk '{print $NF}' | sort | uniq -c | sort -nr

# 检查是否有异常重定向（如跳到外部域名）
grep '301' /var/log/nginx/redirect.log | grep -v 'example.com'

# Loki 日志查询示例
{job="nginx"} |= "301" | logfmt | status_code = "301" | count_over_time(range=1h)

# 保留 POST 方法的永久重定向
return 308 https://new-api.example.com$request_uri;

# 保留 POST 方法的临时重定向
return 307 https://staging-api.example.com$request_uri;

return ResponseEntity.status(HttpStatus.TEMPORARY_REDIRECT)
        .location(URI.create(newUrl))
        .build(); // Spring 默认使用 302，需手动设置 307