fix(oidc-ui): set proxy_http_version 1.1 for backend proxy_pass locations

[bhumi46]

What

oidc-ui's nginx proxy_pass blocks never set proxy_http_version, so nginx sends HTTP/1.0 to the esignet backend by default. Since helm/esignet/templates/service.yaml names the backend Service port http, Istio (when sidecar injection is enabled) applies a strict HTTP/1.1-only codec on that port's inbound Envoy listener, which rejects the HTTP/1.0 request with 426 Upgrade Required.

This fix adds to every proxied location block:

proxy_http_version 1.1;
proxy_set_header   Connection "";

Why

Standard nginx guidance when proxying to any HTTP/1.1-capable (keep-alive) upstream. Fixes the 426 without any Istio/Service changes.

How I verified

Root-caused by testing the same request as HTTP/1.0 vs HTTP/1.1 directly against the backend Service from inside the mesh (via the oidc-ui pod's istio-proxy sidecar):

• curl --http1.0 http://<esignet-service>/v1/esignet/... → 426 Upgrade Required from istio-envoy
• curl --http1.1 (same URL) → normal response from the app

Applied this exact patch live to a running deployment's nginx.conf ConfigMap and confirmed the endpoint changed from 426 Upgrade Required to a normal backend response (405 Method Not Allowed for a GET on a POST-only endpoint, i.e. correctly reaching the app).

Fixes #2559

Summary by CodeRabbit

• Bug Fixes
  • Improved proxy communication with the OIDC service by enabling HTTP/1.1 keep-alive connections for key authentication and discovery endpoints.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 3d6129f7-53f7-44ef-b86c-fe3e0d5c9358

📥 Commits

Reviewing files that changed from the base of the PR and between fbc5b91 and 441e3a7.

📒 Files selected for processing (1)

• helm/oidc-ui/templates/configmap.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The nginx ConfigMap configures HTTP/1.1 upstream proxying for five oidc-ui locations. Each location clears the Connection header for keep-alive-compatible requests.

Changes

OIDC upstream proxy configuration

Layer / File(s)	Summary
Configure HTTP/1.1 proxy locations helm/oidc-ui/templates/configmap.yaml	Adds proxy_http_version 1.1; and proxy_set_header Connection ""; to five proxied locations: API, actuator, JWKS, OpenID configuration, and OAuth authorization server paths.

Priority: ⬆️ High — Impact reflects high issue severity.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Severity of issue fixed: High

Merge Risk: ⚪ Minimal · up to 6b255

OIDC UI backend and discovery proxy requests now use HTTP/1.1 consistently, addressing the upstream protocol rejection without introducing an identified merge-readiness risk.

Suggested reviewers: sacrana0

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: enabling HTTP/1.1 for oidc-ui backend proxy locations.
Linked Issues check	✅ Passed	The changes satisfy issue #2559 by adding proxy_http_version 1.1 and clearing the Connection header in all five required nginx proxy locations. This addresses the HTTP/1.0 and 426 Upgrade Required fai…
Out of Scope Changes check	✅ Passed	All changes are limited to the nginx proxy configuration required by issue #2559. No unrelated code or configuration changes are present. No GDPR or MOSIP compliance impact is identified.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{HTTP/1.1 now carries the stream
Nginx keeps the upstream dream
Empty headers clear the way
Five locations work today
Istio sees the protocol stay}

_{Comment @coderabbitai help to get the list of available commands.}