Open Showfom opened 2 years ago
Looks like this is the known issue of HTTP/2 client connection to a proxy, HTTP/1.1 connection from the proxy to an HTTP/2 capable backend. Nginx uses HTTP/1.1 only to do the proxy in the middle, so the backend HTTP/2 service sends the upgrade header advertising its HTTP/2 credentials to allow an upgrade from the proxy if it can. The problem appears to be nginx frontend leaks that header to the client over the already HTTP/2 connection which it shouldn't by the RFC (curl and safari error on this, others ignore).
This nginx ticket suggests this is the same issue and this ticket suggests that nginx are not going to go to HTTP/2 on the proxy module soon. There is discussion of the proxy_hide_header Upgrade;
but I'm not sure where and how that would break things, does it apply only to the proxy module connection to the backend or also to the frontend client connection? We want NPM to send the upgrade header to HTTP/1.1 clients, but cannot send it if the connection is already HTTP/2.
The backend server is Apache 2.4 with HTTP/2 enabled
Server version: Apache/2.4.51 (Debian)
Apache2 configuration is from Mozilla:
I have added proxy_hide_header Upgrade;
and the problem was solved.
Issue is now considered stale. If you want to keep it open, please comment :+1:
Hi, this issue should absolutely remain open 👍 as it causes nginx-proxy-manager is unusable with default configuration, when HTTPS is used and iPhone users are expected. Related issues: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/571, https://github.com/NginxProxyManager/nginx-proxy-manager/issues/661.
Workaround is provided (add proxy_hide_header Upgrade;
to the Custom Nginx config textbox), but I think this should work out-of-the-box. Should this line be included in the default configuration? I can prepare the Pull Request, if we agree this is the correct fix. What do you think @jc21?
I've investigated it a bit and it seems to cause trouble specifically when the proxy target is supporting HTTP/2 (i.e. Apache2 with HTTP2 enabled), however including the workaround line causes WebSockets stop working.
Thanks in advance and nice day to everyone, D.
Checklist
jc21/nginx-proxy-manager:latest
docker image?Describe the bug
Nginx Proxy Manager Version
2.9.12
To Reproduce Steps to reproduce the behavior:
Operating System
Debian 11