You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Adds a per-proxy-host boolean toggle "Use $http_host (Preserve Port)" in the Details tab
of the proxy host modal. When enabled, nginx sends proxy_set_header Host $http_host and proxy_set_header X-Forwarded-Host $http_host instead of the default proxy_set_header Host $host.
When disabled (default), behaviour is identical to today — zero impact on existing setups.
Why
The nginx variable $host does not preserve the original client port, which breaks applications
that validate the full Host header including port (e.g. ESPHome behind NAT port forwarding,
see also esphome/issues#4327).
Previously, users could not work around this via the Advanced Config field because the default
headers are written after the advanced config block, making override impossible.
Type of Change
Bug fix (non-breaking change that fixes an issue)
New feature (non-breaking change that adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Root cause: Commit 7330d044 ("Loose validation on certificate domain names") removed the
regex pattern from common.json#/properties/domain_names/items, stripping the only validation
that blocked shell injection characters in domain names. The CVE test (Certificates.cy.js)
submits a malicious domain string containing ", |, and spaces and expects the API to return
HTTP 400 with an AJV validation error message containing data/domain_names/0 must match pattern.
Without the pattern, AJV passes validation and the backend tries to call certbot with the
unsanitized input, which crashes with a 500.
Fix: In backend/schema/paths/nginx/certificates/post.json, replace the $ref for domain_names in the request body schema with an inline definition that includes a strict pattern:
This keeps common.json loose (needed for proxy hosts which accept wildcards like *.example.com)
while enforcing strict validation on the certificate creation endpoint specifically, where injection
into certbot arguments is a real attack vector.
Fix 2 — FullCertProvision.cy.js PowerDNS test failing
Root cause: In backend/certbot/dns-plugins.json, the PowerDNS plugin entry has "dependencies": "PyYAML==5.3.1". This is a strict pin to a very old version of PyYAML that
fails to install under Python 3.12+ because it requires compiling a C extension that is no longer
compatible. When the backend tries to provision a DNS certificate using the PowerDNS provider, it
first calls installPlugin("powerdns"), which runs pip install PyYAML==5.3.1 certbot-dns-powerdns~=0.2.1. The pip install fails, the plugin is
never installed, and the certificate request returns 500.
Fix: In backend/certbot/dns-plugins.json, change the pinned PyYAML version in the PowerDNS
entry from an exact pin to a minimum version:
"dependencies": "PyYAML>=5.4"
PyYAML 5.4+ properly supports Python 3.12+ and is compatible with certbot-dns-powerdns ~=0.2.1.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #3981
Adds a per-proxy-host boolean toggle "Use $http_host (Preserve Port)" in the Details tab
of the proxy host modal. When enabled, nginx sends
proxy_set_header Host $http_hostandproxy_set_header X-Forwarded-Host $http_hostinstead of the defaultproxy_set_header Host $host.When disabled (default), behaviour is identical to today — zero impact on existing setups.
Why
The nginx variable
$hostdoes not preserve the original client port, which breaks applicationsthat validate the full
Hostheader including port (e.g. ESPHome behind NAT port forwarding,see also esphome/issues#4327).
Previously, users could not work around this via the Advanced Config field because the default
headers are written after the advanced config block, making override impossible.
Type of Change
AI Usage