nginx-proxy-manager icon indicating copy to clipboard operation
nginx-proxy-manager copied to clipboard

Response headers duplicate when using the add_header nginx config

Open nickelswitte opened this issue 2 years ago • 4 comments

Checklist

  • Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
    • Yes
  • Are you sure you're not using someone else's docker image?
    • Yes
  • Have you searched for similar issues (both open and closed)?
    • Yes

Describe the bug

When adding headers to the response via the advanced custom nginx configuration, the headers are duplicated in the response, rather than overwritten or appended, resulting in unusual behaviour.

Nginx Proxy Manager Version

2.10.2

To Reproduce Steps to reproduce the behavior:

  1. Set the following inside the custom nginx config, as found in this issue #1183
location / {
  # Force SSL
  include conf.d/include/force-ssl.conf;
  # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
  add_header Strict-Transport-Security "max-age=63072000;includeSubDomains; preload" always;
  add_header X-Frame-Options "ALLOW-FROM my.domain.tld";
  add_header Content-Security-Policy "frame-ancestors my.domain.tld";
  # Proxy!
  include conf.d/include/proxy.conf;
}
  1. Load the page and inspect the response in the browser:
HTTP/2 200 OK
server: openresty
date: Sun, 07 May 2023 10:32:39 GMT
content-type: text/html
content-encoding: gzip
x-frame-options: sameorigin #DUPLICATE
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-security-policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'; manifest-src 'self'; media-src 'self' blob:; child-src 'self' blob:; frame-src 'self'; frame-ancestors 'none' #DUPLICATE
referrer-policy: same-origin
permissions-policy: interest-cohort=()
x-frame-options: ALLOW-FROM my.domain.tld #DUPLICATE
content-security-policy: frame-ancestors my.domain.tld #DUPLICATE
X-Firefox-Spdy: h2

Expected behavior

That the header will be appended or replaced, or rather generally, that the browser will accept the duplicate header in some way.

nickelswitte avatar May 07 '23 11:05 nickelswitte

Issue is now considered stale. If you want to keep it open, please comment :+1:

github-actions[bot] avatar Jan 20 '24 01:01 github-actions[bot]

I am still interested in an response on this

nickelswitte avatar Feb 23 '24 12:02 nickelswitte

I got this working finally in NPM

The magic is proxy_hide_header X-Frame-Options;

I added that to the top with the other headers and nothing in advanced tab just in the location > advanced tab

Screenshot 2024-10-26 at 12 00 37 PM

dhruvb14 avatar Oct 26 '24 16:10 dhruvb14

Issue is now considered stale. If you want to keep it open, please comment :+1:

github-actions[bot] avatar Jun 09 '25 02:06 github-actions[bot]