mirror of
https://github.com/NginxProxyManager/nginx-proxy-manager.git
synced 2026-02-12 05:32:57 +00:00
187d21a0d5
When Nginx is behind another proxy server (like CloudFlare or AWS ALB), the force-SSL feature can cause redirect loops because Nginx sees the connection as plain HTTP while SSL is already handled upstream. This adds a new boolean option to trust the X-Forwarded-Proto header from upstream proxies. Changes: - Add `trust_forwarded_proto` column to proxy_host table (migration) - Update model and API schema to support the new boolean field - Modify force-ssl Nginx template to check X-Forwarded-Proto/X-Forwarded-Scheme - Add map directives in nginx.conf to validate and sanitize forwarded headers - Add advanced option toggle in frontend UI with i18n support (EN/ZH) - Set proxy headers from validated map variables instead of $scheme This allows administrators to control SSL redirect behavior when Nginx is deployed behind a TLS-terminating proxy.
69 lines
2.0 KiB
TypeScript
69 lines
2.0 KiB
TypeScript
import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
|
|
import { createProxyHost, getProxyHost, type ProxyHost, updateProxyHost } from "src/api/backend";
|
|
|
|
const fetchProxyHost = (id: number | "new") => {
|
|
if (id === "new") {
|
|
return Promise.resolve({
|
|
id: 0,
|
|
createdOn: "",
|
|
modifiedOn: "",
|
|
ownerUserId: 0,
|
|
domainNames: [],
|
|
forwardHost: "",
|
|
forwardPort: 0,
|
|
accessListId: 0,
|
|
certificateId: 0,
|
|
sslForced: false,
|
|
cachingEnabled: false,
|
|
blockExploits: false,
|
|
advancedConfig: "",
|
|
meta: {},
|
|
allowWebsocketUpgrade: false,
|
|
http2Support: false,
|
|
forwardScheme: "",
|
|
enabled: true,
|
|
hstsEnabled: false,
|
|
hstsSubdomains: false,
|
|
trustForwardedProto: false,
|
|
} as ProxyHost);
|
|
}
|
|
return getProxyHost(id, ["owner"]);
|
|
};
|
|
|
|
const useProxyHost = (id: number | "new", options = {}) => {
|
|
return useQuery<ProxyHost, Error>({
|
|
queryKey: ["proxy-host", id],
|
|
queryFn: () => fetchProxyHost(id),
|
|
staleTime: 60 * 1000, // 1 minute
|
|
...options,
|
|
});
|
|
};
|
|
|
|
const useSetProxyHost = () => {
|
|
const queryClient = useQueryClient();
|
|
return useMutation({
|
|
mutationFn: (values: ProxyHost) => (values.id ? updateProxyHost(values) : createProxyHost(values)),
|
|
onMutate: (values: ProxyHost) => {
|
|
if (!values.id) {
|
|
return;
|
|
}
|
|
const previousObject = queryClient.getQueryData(["proxy-host", values.id]);
|
|
queryClient.setQueryData(["proxy-host", values.id], (old: ProxyHost) => ({
|
|
...old,
|
|
...values,
|
|
}));
|
|
return () => queryClient.setQueryData(["proxy-host", values.id], previousObject);
|
|
},
|
|
onError: (_, __, rollback: any) => rollback(),
|
|
onSuccess: async ({ id }: ProxyHost) => {
|
|
queryClient.invalidateQueries({ queryKey: ["proxy-host", id] });
|
|
queryClient.invalidateQueries({ queryKey: ["proxy-hosts"] });
|
|
queryClient.invalidateQueries({ queryKey: ["audit-logs"] });
|
|
queryClient.invalidateQueries({ queryKey: ["host-report"] });
|
|
queryClient.invalidateQueries({ queryKey: ["certificates"] });
|
|
},
|
|
});
|
|
};
|
|
|
|
export { useProxyHost, useSetProxyHost };
|