starred/nginx-proxy-manager-NginxProxyManager

Fork 0

mirror of https://github.com/NginxProxyManager/nginx-proxy-manager.git synced 2026-04-25 17:35:52 +03:00

[GH-ISSUE #2896] Response headers duplicate when using the add_header nginx config #1985

New issue

Open

opened 2026-02-26 07:33:34 +03:00 by kerem · 4 comments

kerem commented

2026-02-26 07:33:34 +03:00

Owner

Originally created by @nickelswitte on GitHub (May 7, 2023).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/2896

Checklist

Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
- Yes
Are you sure you're not using someone else's docker image?
- Yes
Have you searched for similar issues (both open and closed)?
- Yes

Describe the bug

When adding headers to the response via the advanced custom nginx configuration, the headers are duplicated in the response, rather than overwritten or appended, resulting in unusual behaviour.

Nginx Proxy Manager Version

2.10.2

To Reproduce
Steps to reproduce the behavior:

Set the following inside the custom nginx config, as found in this issue #1183

location / {
  # Force SSL
  include conf.d/include/force-ssl.conf;
  # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
  add_header Strict-Transport-Security "max-age=63072000;includeSubDomains; preload" always;
  add_header X-Frame-Options "ALLOW-FROM my.domain.tld";
  add_header Content-Security-Policy "frame-ancestors my.domain.tld";
  # Proxy!
  include conf.d/include/proxy.conf;
}

Load the page and inspect the response in the browser:

HTTP/2 200 OK
server: openresty
date: Sun, 07 May 2023 10:32:39 GMT
content-type: text/html
content-encoding: gzip
x-frame-options: sameorigin #DUPLICATE
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-security-policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'; manifest-src 'self'; media-src 'self' blob:; child-src 'self' blob:; frame-src 'self'; frame-ancestors 'none' #DUPLICATE
referrer-policy: same-origin
permissions-policy: interest-cohort=()
x-frame-options: ALLOW-FROM my.domain.tld #DUPLICATE
content-security-policy: frame-ancestors my.domain.tld #DUPLICATE
X-Firefox-Spdy: h2

Expected behavior

That the header will be appended or replaced, or rather generally, that the browser will accept the duplicate header in some way.

Originally created by @nickelswitte on GitHub (May 7, 2023). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/2896  **Checklist** - Have you pulled and found the error with `jc21/nginx-proxy-manager:latest` docker image? - Yes - Are you sure you're not using someone else's docker image? - Yes - Have you searched for similar issues (both open and closed)? - Yes **Describe the bug**  When adding headers to the response via the _advanced custom nginx configuration_, the headers are duplicated in the response, rather than overwritten or appended, resulting in unusual behaviour. **Nginx Proxy Manager Version**  2.10.2 **To Reproduce** Steps to reproduce the behavior: 1. Set the following inside the custom nginx config, as found in this issue #1183 ``` location / { # Force SSL include conf.d/include/force-ssl.conf; # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years) add_header Strict-Transport-Security "max-age=63072000;includeSubDomains; preload" always; add_header X-Frame-Options "ALLOW-FROM my.domain.tld"; add_header Content-Security-Policy "frame-ancestors my.domain.tld"; # Proxy! include conf.d/include/proxy.conf; } ``` 2. Load the page and inspect the response in the browser: ``` HTTP/2 200 OK server: openresty date: Sun, 07 May 2023 10:32:39 GMT content-type: text/html content-encoding: gzip x-frame-options: sameorigin #DUPLICATE x-xss-protection: 1; mode=block x-content-type-options: nosniff content-security-policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'; manifest-src 'self'; media-src 'self' blob:; child-src 'self' blob:; frame-src 'self'; frame-ancestors 'none' #DUPLICATE referrer-policy: same-origin permissions-policy: interest-cohort=() x-frame-options: ALLOW-FROM my.domain.tld #DUPLICATE content-security-policy: frame-ancestors my.domain.tld #DUPLICATE X-Firefox-Spdy: h2 ``` **Expected behavior**  That the header will be appended or replaced, or rather generally, that the browser will accept the duplicate header in some way.

kerem added the

stale

bug

labels

2026-02-26 07:33:34 +03:00

kerem commented

2026-02-26 07:33:35 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Jan 20, 2024):

Issue is now considered stale. If you want to keep it open, please comment 👍

@github-actions[bot] commented on GitHub (Jan 20, 2024): Issue is now considered stale. If you want to keep it open, please comment :+1:

kerem commented

2026-02-26 07:33:35 +03:00

Author

Owner

@nickelswitte commented on GitHub (Feb 23, 2024):

I am still interested in an response on this

@nickelswitte commented on GitHub (Feb 23, 2024): I am still interested in an response on this

kerem commented

2026-02-26 07:33:35 +03:00

Author

Owner

@dhruvb14 commented on GitHub (Oct 26, 2024):

I got this working finally in NPM

The magic is proxy_hide_header X-Frame-Options;

I added that to the top with the other headers and nothing in advanced tab just in the location > advanced tab

@dhruvb14 commented on GitHub (Oct 26, 2024): I got this working finally in NPM The magic is `proxy_hide_header X-Frame-Options;` I added that to the top with the other headers and nothing in advanced tab just in the `location` > `advanced` tab <img width="509" alt="Screenshot 2024-10-26 at 12 00 37 PM" src="https://github.com/user-attachments/assets/20e57ebc-460d-4441-85f2-f96c08812a0a">

kerem commented

2026-02-26 07:33:35 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Jun 9, 2025):

Issue is now considered stale. If you want to keep it open, please comment 👍

@github-actions[bot] commented on GitHub (Jun 9, 2025): Issue is now considered stale. If you want to keep it open, please comment :+1:

kerem referenced this issue

2026-02-26 08:30:57 +03:00

[PR #1985] [CLOSED] Add Scaleway DNS provider #3518

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#1985

No description provided.

Rows
Columns