Workaround - Security Headers @ NGINX Proxy Manager

_hsts.conf

{% if certificate and certificate_id > 0 -%}
{% if ssl_forced == 1 or ssl_forced == true %}
{% if hsts_enabled == 1 or hsts_enabled == true %}
  # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
  add_header Strict-Transport-Security "max-age=63072000;{% if hsts_subdomains == 1 or hsts_subdomains == true -%} includeSubDomains;{% endif %} preload" always;
  add_header Referrer-Policy strict-origin-when-cross-origin; 
  add_header X-Content-Type-Options nosniff;
  add_header X-XSS-Protection "1; mode=block";
  add_header X-Frame-Options SAMEORIGIN;
  add_header Content-Security-Policy upgrade-insecure-requests;
  add_header Permissions-Policy interest-cohort=();
  add_header Expect-CT 'enforce; max-age=604800';
  more_set_headers 'Server: Proxy';
  more_clear_headers 'X-Powered-By';
{% endif %}
{% endif %}
{% endif %}

Hi,

I am having issue with setting up the Strict-Transport-Security. Here is my _hsts.conf:

{% if certificate and certificate_id > 0 -%}
{% if ssl_forced == 1 or ssl_forced == true %}
{% if hsts_enabled == 1 or hsts_enabled == true %}
  # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
  add_header Strict-Transport-Security "max-age=15552000;{% if hsts_subdomains == 1 or hsts_subdomains == true -%} includeSubDomains;{% endif %} preload" always;
  add_header Referrer-Policy strict-origin-when-cross-origin;
  add_header X-Content-Type-Options nosniff;
  add_header Content-Security-Policy upgrade-insecure-requests;
  add_header Permissions-Policy interest-cohort=();
  add_header Expect-CT 'enforce; max-age=604800';
  more_set_headers 'Server: Proxy';
  more_clear_headers 'X-Powered-By';
{% endif %}
{% endif %}
{% endif %}

You might notice that referrer-policy and x-content-type-options appear twice in the above image.
What am I missing? any ideas?

No not your fault... This happens when the application you're proxying has headers too...

Edit: Ah, you found your answer already. Issue: NginxProxyManager/nginx-proxy-manager#1601

Hi @R0GGER,

thanks for the reply. As I mentioned, it was cloud flare who was adding or replacing my own header values.

Hey,
I know this is pretty old by now, but I was wondering if it is possible to change the Server header. Changed it in the _hsts.conf, but it doesnt change(Have tried restart and recreate). Is it simply not possible, or am I doing something wrong?

Hi shruub,

Paths depend on which NGINX Proxy Manager docker image you're using...
Before you add /your host/_hsts.conf:/opt/nginx-proxy-manager/templates/_hsts.conf:ro to your docker-compose file of docker cli , make sure you've saved _hsts.conf on the host.

Once NGINX Proxy Manager is running again, just go to a proxy host, click edit, tab: ssl, click enable HSTS Enabled and HSTS Subdomains and Save.

Hello rogger,
thanks for the fast response, issue is fixed after disabling and re-enabling HSTS and subdomains! :)

It doesn't seem to be working for me. I get an F on securityheaders.com . Do i only need to create that file and enable HSTS? I'm trying to fix CORS error on the homer dashboard.
I also added
add_header Access-Control-Allow-Origin *;
but like the other headers, it doesn't work.

Is the _hsts.conf supposed to be next to the _assets.conf dead_host.conf _exploits.conf _header_comment.conf , etc, files?

Edit: I noticed that it somehow works. While using the browser inspector i can see that some files get the headers and some don't

Thanks for sharing your config !
As said on a comment the problem is that if an application already has on of those header, the same header (maybe with a different value) is added by NPM, wich could cause issue and is not following the standards.

So I made so changes :

First here is my _hsts.conf file :

{% if certificate and certificate_id > 0 -%}
{% if ssl_forced == 1 or ssl_forced == true %}
{% if hsts_enabled == 1 or hsts_enabled == true %}
add_header Strict-Transport-Security $hdr_strict_transport_security;
add_header Referrer-Policy $hdr_referrer_policy;
add_header X-Content-Type-Options $hdr_x_content_type_options;
add_header X-XSS-Protection $hdr_x_xss_protection;
add_header X-Frame-Options $hdr_x_frame_options;
add_header Content-Security-Policy $hdr_content_security_policy;
add_header Permissions-Policy $hdr_permissions_policy;
add_header Expect-CT $hdr_expect_ct;
more_set_headers 'Server: Proxy';
more_clear_headers 'X-Powered-By';
{% endif %}
{% endif %}
{% endif %}

Then I created (or modified) in /data/nginx/custom a http_top.conf file :

map $upstream_http_strict_transport_security $hdr_strict_transport_security {
'' "max-age=63072000; includeSubDomains; preload";
}

map $upstream_http_referrer_policy $hdr_referrer_policy {
'' "strict-origin-when-cross-origin";
}

map $upstream_http_x_content_type_options $hdr_x_content_type_options {
'' "nosniff";
}

map $upstream_http_x_xss_protection $hdr_x_xss_protection {
'' "1; mode=block";
}

map $upstream_http_x_frame_options $hdr_x_frame_options {
'' "SAMEORIGIN";
}

map $upstream_http_content_security_policy $hdr_content_security_policy {
'' "upgrade-insecure-requests";
}

map $upstream_http_permissions_policy $hdr_permissions_policy {
'' "interest-cohort=()";
}

map $upstream_http_expect_ct $hdr_expect_ct {
'' "enforce, max-age=604800";
}

Than restarting nginx and disabling SSL and saving in NPM, and enabling it again.
With this configuration nginx only adds those header if they are not already send by the underling application.

The only thing is if you want to disable on of those header (X-frame for me) on a specified application, you have to put the entire configuration for this application in the advanced tap with "location/{ ....}

@maximushugus Thanks for sharing your config and updates! Works like a charm! :-)