Large file upload fails due to misconfiguration of external reverse proxy (Error parsing upload query args)

Symptoms

While smaller file uploads work perfectly, a large file upload fails.
It does not happen when the upload happens when accessing Parallels Secure Workspace by navigating to its internal IP address.

In the awingu-file-proxy.service.log, check if you see a similar error message.

2022-08-17 12:27:13.164100 nightly-install-master awingu-file-proxy.service[awingu-file-proxy:1790]: [ERROR] - Error parsing upload query args
Traceback (most recent call last):
  File "/opt/awingu/awingu-core/virtualenv/lib/python3.10/site-packages/awingufileproxy/base.py", line 269, in parse_token
    token = jwt.JWT(jwt=token_enc.payload.decode(), key=key).token
  File "/opt/awingu/awingu-core/virtualenv/lib/python3.10/site-packages/jwcrypto/jwt.py", line 209, in __init__
    self.deserialize(jwt, key)
  File "/opt/awingu/awingu-core/virtualenv/lib/python3.10/site-packages/jwcrypto/jwt.py", line 554, in deserialize
    self.validate(key)
  File "/opt/awingu/awingu-core/virtualenv/lib/python3.10/site-packages/jwcrypto/jwt.py", line 524, in validate
    self._check_provided_claims()
  File "/opt/awingu/awingu-core/virtualenv/lib/python3.10/site-packages/jwcrypto/jwt.py", line 391, in _check_provided_claims
    self._check_default_claims(claims)
  File "/opt/awingu/awingu-core/virtualenv/lib/python3.10/site-packages/jwcrypto/jwt.py", line 361, in _check_default_claims
    self._check_exp(claims['exp'], time.time(), self._leeway)
  File "/opt/awingu/awingu-core/virtualenv/lib/python3.10/site-packages/jwcrypto/jwt.py", line 341, in _check_exp
    raise JWTExpired('Expired at %d, time: %d(leeway: %d)' % (
jwcrypto.jwt.JWTExpired: Expired at 1660739096, time: 1660739233(leeway: 60)

Additionally, when using the browser's Developer Tools, a similar issue can be seen in the response to one of the HTTP requests in the Network tab.

Cause

This is due to the configuration of the external reverse proxy.

Resolution

It does not happen when the upload happens directly to Parallels Secure Workspace (with no reverse proxy involved), or if you set the following in the external Nginx reverse proxy config:

location /upload/ {
    client_max_body_size 0;

    proxy_pass http://frontends/upload/;
    proxy_request_buffering off;
    proxy_buffering off;
    proxy_cache off;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}