Reverse proxy for Unifi network controller for Caddy >= 2.11

[matt (Matt Holt)]

@no6mis

So for anyone else affected, this seems to be the more reliable workaround:

header_up Host {hostport}

instead of only:

header_up Host {host}

I wanted to share that in case it helps others who run into the same issue.

Yeah, I agree. I recommend {hostport} in the original issue where regressions were posted:

@no6mis

When a change can break established reverse proxy setups in non-obvious ways, it would be much easier on users if that were either reserved for a major version, made opt-in, or communicated much more prominently as a breaking change.

The breakage is actually obvious which was part of the point. Clarifying the factors we considered for this:

• Alternative (previous behavior) is non-obvious insecurity. Application functions but has security vulnerabilities in some cases.
• This behavior breaks in an obvious way, and has an easy fix: header_up Host {hostport}
• Practically, this change mostly only affects those connections where tls_insecure_skip_verify is used, and these are not really officially considered legitimate production use cases. Disabling security is just not a great solution in any case. Caddy can fully automate internal PKI and apps or Caddy, one way or another, can be configured to properly trust the certs. (And I am not sure I have seen a complaint where this option was not used.)

So, I think in the grand scheme of things, breakage was actually very minimal, obvious, and seems to be limited to controversial configs anyway…

Sorry the release notes were not more clear. We did highlight this change, but maybe it needed a or something?