[GH-ISSUE #5009] Mixed Content Warning on Basic Authentication Page (HTTP instead of HTTPS) #3094

New issue

Open

opened 2026-02-26 07:37:50 +03:00 by kerem · 1 comment

kerem commented

2026-02-26 07:37:50 +03:00

Owner

Originally created by @robeston on GitHub (Dec 2, 2025).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/5009

Hello,

A "Mixed Content" warning is experienced (indicated by a gray globe/info icon instead of a green padlock) on the built-in Nginx Proxy Manager Basic Authentication (Password Protection) page when accessing a host over HTTPS (port 443).

The SSL certificate is valid. The backend application works fine with HTTPS after logging in. The issue is specific to the NPM's custom login prompt page itself.

It seems the built-in authentication template is loading an asset (like an image or CSS file) using an absolute http:// URL instead of https:// or a relative URL.

To Reproduce:

Set up a host in NPM with SSL enabled and "Access Lists" or "Basic Authentication" applied.
Navigate to the host URL via HTTPS (pl. https://testpage.ddns.net).
The browser displays the password prompt, but flags the connection as insecure due to mixed content.

Expected behavior:
The Basic Authentication prompt page should load all assets over HTTPS to display a secure green padlock icon.

Thank you for your help.

Originally created by @robeston on GitHub (Dec 2, 2025). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/5009 Hello, A "Mixed Content" warning is experienced (indicated by a gray globe/info icon instead of a green padlock) on the built-in Nginx Proxy Manager Basic Authentication (Password Protection) page when accessing a host over HTTPS (port 443). The SSL certificate is valid. The backend application works fine with HTTPS after logging in. The issue is specific to the NPM's custom login prompt page itself. It seems the built-in authentication template is loading an asset (like an image or CSS file) using an absolute `http://` URL instead of `https://` or a relative URL. **To Reproduce:** 1. Set up a host in NPM with SSL enabled and "Access Lists" or "Basic Authentication" applied. 2. Navigate to the host URL via HTTPS (pl. https://testpage.ddns.net). 3. The browser displays the password prompt, but flags the connection as insecure due to mixed content. **Expected behavior:** The Basic Authentication prompt page should load all assets over HTTPS to display a secure green padlock icon. Thank you for your help.

kerem added the

bug

label

2026-02-26 07:37:50 +03:00

kerem commented

2026-02-26 07:37:50 +03:00

Author

Owner

@7heMech commented on GitHub (Dec 3, 2025):

Why are you opening a duplicate issue #4984

@7heMech commented on GitHub (Dec 3, 2025): Why are you opening a duplicate issue #4984

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#3094

No description provided.

Rows
Columns