starred/nginx-proxy-manager-NginxProxyManager

Fork 0

mirror of https://github.com/NginxProxyManager/nginx-proxy-manager.git synced 2026-04-25 17:35:52 +03:00

[GH-ISSUE #1005] Unnecessary HSTS header over HTTP #846

New issue

Closed

opened 2026-02-26 06:34:39 +03:00 by kerem · 4 comments

kerem commented

2026-02-26 06:34:39 +03:00

Owner

Originally created by @DarioViva42 on GitHub (Apr 9, 2021).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1005

I wanted to add my Website to the hsts-preload list: https://hstspreload.org/
With the current configuration I was able to add my site to the list. But I still have this very annoying message.
The hsts header should only be added if i access the page with https, but not when i access it over http.

I have tried a lot of different methods over the last days, but none seemed to work. First I tried to add the header in my node application instead of in the npm (not node package manager, but nginx proxy manager). But this obviously does not work, as the https terminates at the npm. so req.connection.enrypted is always undefined.

var proto = req.connection.encrypted ? 'https' : 'http';
if (proto =="https") {
  res.setHeader("Strict-Transport-Security", "max-age=31536000;includeSubDomains; preload");
}

I also tried to solve it in the advanced settings:

but this immediately makes the applikation stop working.

It really seemes that I am not able to solve this problem on my own and I need your help. I think the problem needs to be tackled inside npm itself.

Kind Regards

Dario Viva

Originally created by @DarioViva42 on GitHub (Apr 9, 2021). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1005 ![grafik](https://user-images.githubusercontent.com/45972949/114214087-2adf7900-9964-11eb-8d9e-5851c6dda60e.png) I wanted to add my Website to the hsts-preload list: https://hstspreload.org/ With the current configuration I was able to add my site to the list. But I still have this very annoying message. The hsts header should only be added if i access the page with https, but not when i access it over http. ![grafik](https://user-images.githubusercontent.com/45972949/114216081-b8bc6380-9966-11eb-9810-c325afdf28b5.png) I have tried a lot of different methods over the last days, but none seemed to work. First I tried to add the header in my node application instead of in the npm (not node package manager, but nginx proxy manager). But this obviously does not work, as the https terminates at the npm. so req.connection.enrypted is always undefined. ```js var proto = req.connection.encrypted ? 'https' : 'http'; if (proto =="https") { res.setHeader("Strict-Transport-Security", "max-age=31536000;includeSubDomains; preload"); } ``` I also tried to solve it in the advanced settings: ![grafik](https://user-images.githubusercontent.com/45972949/114215573-097f8c80-9966-11eb-82c8-b148740be623.png) but this immediately makes the applikation stop working. ![grafik](https://user-images.githubusercontent.com/45972949/114215749-464b8380-9966-11eb-9267-a5cba4f2675a.png) It really seemes that I am not able to solve this problem on my own and I need your help. I think the problem needs to be tackled inside npm itself. Kind Regards Dario Viva

kerem

2026-02-26 06:34:39 +03:00

closed this issue
added the
bug
label

kerem commented

2026-02-26 06:34:40 +03:00

Author

Owner

@l4rm4nd commented on GitHub (Jun 22, 2021):

Put the following line into your advanced configuration of npm:

include conf.d/include/force-ssl.conf;

This ensures that your site is only accessible by an encrypted communication channel (HTTPS). If a request occurs on HTTP, a redirect to HTTPS will take place.

@l4rm4nd commented on GitHub (Jun 22, 2021): Put the following line into your advanced configuration of npm: `include conf.d/include/force-ssl.conf;` ![image](https://user-images.githubusercontent.com/21357789/122946278-87561000-d379-11eb-9c9a-247f9595ef6f.png) This ensures that your site is only accessible by an encrypted communication channel (HTTPS). If a request occurs on HTTP, a redirect to HTTPS will take place.

kerem commented

2026-02-26 06:34:40 +03:00

Author

Owner

@DarioViva42 commented on GitHub (Dec 2, 2023):

@l4rm4nd sorry for taking so long to respond to you (wow its more than two years past)
I just wanted you to inform you that your solution sadly did not work.
But I found something that should probably work.
https://websistent.com/add-the-hsts-header-only-for-https-requests-nginx/
but this configuration can probably not changed easily by myself.
when i add map into the Custom Nginx Configuration field the service goes offline.

@DarioViva42 commented on GitHub (Dec 2, 2023): @l4rm4nd sorry for taking so long to respond to you (wow its more than two years past) I just wanted you to inform you that your solution sadly did not work. But I found something that should probably work. https://websistent.com/add-the-hsts-header-only-for-https-requests-nginx/ but this configuration can probably not changed easily by myself. when i add map into the Custom Nginx Configuration field the service goes offline.

kerem commented

2026-02-26 06:34:40 +03:00

Author

Owner

@andresatierf commented on GitHub (Jan 24, 2024):

@jc21 I believe this change causes something to break. I don't know a lot about nginx but recently I can't add a location block to my proxy hosts without them going offline. I looked around for the problem and found this in the db

as well as this change compared to previously created files

(sorry for the colorscheme)

@andresatierf commented on GitHub (Jan 24, 2024): @jc21 I believe this change causes something to break. I don't know a lot about nginx but recently I can't add a location block to my proxy hosts without them going offline. I looked around for the problem and found this in the db ![image](https://github.com/NginxProxyManager/nginx-proxy-manager/assets/29847057/e334cb75-062a-4362-8bcb-d33a24253a92) as well as this change compared to previously created files ![image](https://github.com/NginxProxyManager/nginx-proxy-manager/assets/29847057/16fbf871-4670-4280-bde1-52175117d3e4) (sorry for the colorscheme)

kerem commented

2026-02-26 06:34:40 +03:00

Author

Owner

@DarioViva42 commented on GitHub (Jan 24, 2024):

Hey @andresatierf
I am sorry if this change really causes your break. I modified the files to the best of my knowledge, but I was never able to build it locally.
@jc21 was so kind to merge this, so I figured that my commit was alright.

@DarioViva42 commented on GitHub (Jan 24, 2024): Hey @andresatierf I am sorry if this change really causes your break. I modified the files to the best of my knowledge, but I was never able to build it locally. @jc21 was so kind to merge this, so I figured that my commit was alright.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#846

No description provided.

Rows
Columns