From 24492dfd3f0dd446ca1fd39e157dd4685772a30d Mon Sep 17 00:00:00 2001 From: Ivan Razin Date: Fri, 3 Jul 2026 16:16:00 +0300 Subject: [PATCH] Fix diag redirects pointing at internal :7443 (unreachable by browser) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The panel vhost listens on 7443 behind the SNI stream (public port is 443). nginx builds absolute redirect Location headers from the server's listen port, so `return 302 /path` in the diag SSO bridge emitted `Location: https://:7443/...`. Browsers followed that to port 7443, which UFW blocks (only 22/80/443 open) → the diagnostics page hung and never loaded. Set `absolute_redirect off` on the panel vhost so nginx emits relative Location headers; the browser resolves them against the real origin (:443). Verified with nginx: listen 7443 + return 302 goes from `http://host:7443/panelXXXX/` to a bare `/panelXXXX/`. This was the actual cause of the "diagnostics page doesn't load after panel login" report; earlier fixes addressed real but secondary issues on the same path. Co-Authored-By: Claude Fable 5 --- x-ui-latest.sh | 4 ++++ x-ui-patch.sh | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/x-ui-latest.sh b/x-ui-latest.sh index e8c11c7..2f48377 100644 --- a/x-ui-latest.sh +++ b/x-ui-latest.sh @@ -457,6 +457,10 @@ server { root /var/www/html/; real_ip_header proxy_protocol; set_real_ip_from 127.0.0.1; + # This vhost listens on 7443 behind the SNI stream (public port 443). Without + # this, nginx bakes :7443 into redirect Location headers (return/error_page), + # so browsers get sent to an unreachable port. Keep redirects relative. + absolute_redirect off; # Larger h2 preread window improves single-stream upload throughput http2_body_preread_size 128k; client_body_buffer_size 512k; diff --git a/x-ui-patch.sh b/x-ui-patch.sh index bf7d72e..39e99c7 100644 --- a/x-ui-patch.sh +++ b/x-ui-patch.sh @@ -328,6 +328,10 @@ server { root /var/www/html/; real_ip_header proxy_protocol; set_real_ip_from 127.0.0.1; + # This vhost listens on 7443 behind the SNI stream (public port 443). Without + # this, nginx bakes :7443 into redirect Location headers (return/error_page), + # so browsers get sent to an unreachable port. Keep redirects relative. + absolute_redirect off; # Larger h2 preread window improves single-stream upload throughput http2_body_preread_size 128k; client_body_buffer_size 512k;