title: Nginx redirects .well-known endpoints
body: <p>I have a web application that runs on <code>WSGI</code> server. The application has OpenID Connect identity provider endpoints, for instance:</p>
  
  <pre><code>/oidc/.well-known/openid-configuration
  /oidc/.well-known/simple-web-discovery
  /oidc/.well-known/webfinger
  </code></pre>
  
  <p>Requests to these endpoints are mapped to some functions in my project, which run necessary tasks for each endpoint. I can run my application, and all requests are successfully mapped and handled by the defined functions. </p>
  
  <p>The challenge starts when I host my application on a public IP behind https. For this I use <code>nginx</code> to proxy access to my application. <code>nginx</code> makes my application accessible over a public IP over https. Here is key sections of my <code>nginx</code> config file: </p>
  
  <pre><code>server {
      listen       80;
      listen       [::]:80 default_server;
      server_name  localhost;
      root         /home/user/myApp;
      include /etc/nginx/default.d/*.conf;
      location / {
          proxy_pass http://my_app;
          proxy_set_header X-Forwarded-Host $host;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-URL-SCHEME https;
      }
  }
  
  server {
      listen       443 ssl;
      server_name  localhost;
      root         /home/user/myApp;
      ssl_certificate /home/user/cacert.pem;
      ssl_certificate_key /home/user/privkey.pem;
      include /etc/nginx/default.d/*.conf;
      location ~ /\.well-known { allow all; }
      location / {
          proxy_pass http://my_app;
          proxy_set_header X-Forwarded-Host $host;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-URL-SCHEME https;
      }
  }
  </code></pre>
  
  <p>Every call is requested/posted correctly, except for the requests to <code>/.well-known/*</code> (actually <code>location ~ /\.well-known { allow all; }</code> in the config is an attempt to solve it), for which I get either <code>404</code> or <code>403</code> errors. </p>
  
  <p>For instance, one error message in <code>nginx</code> error log reads:</p>
  
  <p><code>open() "/home/user/myApp/oidc/.well-known/openid-configuration" failed (13: Permission denied), client: X.X.X.X, server: localhost, request: "GET /oidc/.well-known/openid-configuration HTTP/1.1", host: "X.X.X.X"</code></p>
  
  <p>(IP addresses are masked out)</p>
  
  <p>Few points: </p>
  
  <ul>
  <li>I'm running my application with <code>sudo</code> privileges, so the application has r/w access to all the paths.</li>
  <li>Actually, the path <code>/home/user/myApp/oidc/.well-known/openid-configuration</code> does not exist (and thats why I also get <code>404</code> error). </li>
  </ul>
  
  <p><code>/oidc/.well-known/openid-configuration</code> should be mapped to a function (as it happens when I host my application without <code>nginx</code>). So, I don't understand why <code>nginx</code> tries to access a non-existing <code>/oidc/.well-known/*</code> path/file ?!</p>