fix: incorrect/invalid HSTS policy for proxy hosts (#4471)

[tm-frs]

Why

Fixes #4471
With a proxy host, when the upstream server itself includes an HTTP header for HSTS (e.g. Nextcloud), it is currently kept. When enabling HSTS in NPM, it adds another one, so there will be two of those (which is invalid, and HSTS will not work at all), and (haven't explicitly checked, but I'd imagine) when HSTS is disabledin NPM, it'll actually be enabled due to the upstream header. So, when an upstream server sends an HSTS header, the setting within NPM is actually kinda reversed (HSTS on when setting is off, HSTS invalid/off when setting is on). This is not desireable and unexpected.

I fixed that by adding a directive to the proxy host template that removes any pre-existing HSTS headers; afterwards, if enabled, NPM will add its own.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Code refactoring
• API changes
• Performance improvement
• Test addition or update

AI Usage

• AI was used to write this
• AI was used to review this

NOTE: I have not yet tested this change itself; I verified it works when adding that to the custom nginx options in the proxy host settings (which did what I expected and wanted). I will later test these changes to the template.

[tm-frs]

This does not seem to be related to my change, is that broken?

[nginxproxymanagerci]

Docker Image for build 3 is available on DockerHub:

nginxproxymanager/nginx-proxy-manager-dev:pr-5714

Note

Ensure you backup your NPM instance before testing this image! Especially if there are database changes.
This is a different docker image namespace than the official image.

Warning

Changes and additions to DNS Providers require verification by at least 2 members of the community!

[tm-frs]

Well, I don't know if it was just temporary or not, but I literally force-pushed the same unchanged amended commit again; and two times the build system failed, now it succeeded.

[tm-frs]

After a bit of fighting with my local setup, I managed to test my changes and can confirm it works as intended. I tested

• upstream without HSTS, NPM without HSTS -> no header
• upstream without HSTS, NPM with HSTS -> just one header
• upstream with HSTS, NPM without HSTS -> no header
• upstream with HSTS, NPM with HSTS -> just one header

So there are no invalid or undesireable states.