question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Site not loading when proxied through nginx

See original GitHub issue

Is it a duplicate question? No

Describe the bug A clear and concise description of what the bug is.

To Reproduce Steps to reproduce the behavior:

  1. Proxy site though nginx
  2. add security headers:
	add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Feature-Policy "autoplay 'none'; camera 'none'" always;
        add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; prel>
        add_header Content-Security-Policy "default-src 'self'; font-src *;img-src * da>
        add_header X-XSS-Protection "1; mode=block";
        add_header Referrer-Policy "strict-origin";

  1. Go to site

Expected behavior It should load

Info Uptime Kuma Version: 1.7.3 Using Docker?: No Docker Version: Node.js Version (Without Docker only): v15.12.0 OS: Ubuntu 20.04 LTS Browser: Firefox, but also tested on chrome and safari

Screenshots Screen Shot 2021-10-04 at 4 05 22 PM Screen Shot 2021-10-04 at 4 05 31 PM Screen Shot 2021-10-04 at 4 05 36 PM Screen Shot 2021-10-04 at 4 05 43 PM Screen Shot 2021-10-04 at 4 05 50 PM Screen Shot 2021-10-04 at 4 05 56 PM Screen Shot 2021-10-04 at 4 06 04 PM

Error Log See screenshots

Issue Analytics

  • State:closed
  • Created 2 years ago
  • Comments:12 (3 by maintainers)

github_iconTop GitHub Comments

3reactions
ugurerkancommented, Oct 4, 2021

It is blocking because of content security policy header.
add_header Content-Security-Policy "default-src 'self'; font-src *;img-src * da>

From the screenshots looks like you had to allow, inline and eval resources for script and style. These tools, may help to tinker with rules and solve the issue.

2reactions
Oaktribecommented, Oct 4, 2021

Try this add_header Content-Security-Policy "default-src 'self'; font-src *;img-src * da>; script-src 'unsafe-eval' 'unsafe-inline'"

The first link ugurerkan shared helped me get that.

Read more comments on GitHub >

github_iconTop Results From Across the Web

NGINX Reverse proxy not loading resources - Server Fault
With this in place, I get the main/default internal app index page, but the view source shows me that no link stylesheets, js,...
Read more >
proxy - nginx simple proxy_pass to localhost not working
If I ssh to the machine and run curl http://127.0.0.1:3000/ , I get the desired result (and eventually I ran that server on...
Read more >
Avoiding the Top 10 NGINX Configuration Mistakes
We help you avoid the 10 most common NGINX configuration errors, explaining the problems caused by each and how to fix them.
Read more >
NGINX Reverse Proxy Configuration and Troubleshooting
To solve this issue in nginx, need re-install nginx (you may need re-compile) with openssl library (Not LibreSSL provided by Mac OS). 504 ......
Read more >
Why is reverse proxy is not working with nginx? - DigitalOcean
I am trying to setup nginx reverse proxy on that application so that I can access it through port 80. If you want...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found