Traefik does not handle X-Accel-Redirect header returned by Django

[954-Ivory]

Problem: X-Accel-Redirect doesn't work correctly with Traefik as reverse proxy

Context

I'm using cookiecutter-django along with django-protected-media to serve private media files via X-Accel-Redirect. This mechanism works well when using nginx directly as the reverse proxy.

However, when using Traefik as the main ingress (as recommended in cookiecutter-django), X-Accel-Redirect becomes ineffective and results in empty responses.

Behavior Diagram

Browser
  |
  v
Traefik (forwards the request to Django)
  |
  v
Django returns a response with the `X-Accel-Redirect` header
  |
  v
Traefik forwards this response (with header, but empty body) to the browser,
      instead of passing the request to nginx to serve the actual file

Root Cause

Traefik does not support X-Accel-Redirect internally — this is an nginx-only feature.

Traefik acts only as a forwarding proxy; it doesn’t interpret or process the X-Accel-Redirect header. Therefore, any attempt to use it directly with django-protected-media and Traefik alone results in:

• a 200 OK response
• with a X-Accel-Redirect header
• but an empty body, because nginx never sees or handles the internal redirect

[browniebroke]

Never heard of X-Accel-Redirect before, sorry. Also, what is the question?

[954-Ivory]

Context

I'm using django-protected-media, which relies on X-Accel-Redirect — an nginx-only feature that lets Django return a special header to internally redirect file serving to nginx (without exposing the protected file path or using Django to stream large files).

Problem

X-Accel-Redirect does not work if you're using Traefik → Django directly. This is because Traefik does not support internal redirects based on X-Accel-Redirect. As a result, the browser receives a response with the X-Accel-Redirect header, but no file is served.

---

Correct Architecture

To properly serve private media using X-Accel-Redirect, the flow should be:

Browser
  |
  v
Traefik (reverse proxy, TLS termination, routing)
  |
  v
Nginx (intercepts internal `/protected/` or `/internal/` paths)
  |
  v
Django (returns `X-Accel-Redirect: /internal/path/to/file`)
         ↓
      Nginx receives and processes the internal redirect,
      and serves the actual file to the client

I'm currently using this architecture: Traefik → nginx → Django, and it works as expected. The internal redirect is correctly handled by nginx and the protected files are served securely.

[browniebroke]

This is pretty much the same thing as your original message with zero new information and looks LLM generated.

Be mindful about your use of generative AI when sending messages to open source maintainers. I don't have time for this. If Traefik doesn't work, use nginx.

[954-Ivory]

This is pretty much the same thing as your original message with zero new information and looks LLM generated.

Be mindful about your use of generative AI when sending messages to open source maintainers. I don't have time for this. If Traefik doesn't work, use nginx.

Yes, I asked LLM to summarize the problem.

It took me a while to locate this issue, but it might help if someone else is having the same problem.