ERR_HTTP2_PROTOCOL_ERROR with chrome

[arthurlutz]

Deploying a SPIP site with yunohost works great! But when trying to reach the site with chromium or chrome we get :

This site can’t be reachedThe webpage at https://www.soundsmag.org/ might be temporarily down or it may have moved permanently to a new web address.
ERR_HTTP2_PROTOCOL_ERROR

Example : https://www.soundsmag.org/

[arthurlutz]

Commenting the set_headers :

	# Add headers to serve security related headers
	#more_set_headers Strict-Transport-Security "max-age=15768000;";
	#more_set_headers X-Content-Type-Options nosniff;
	#more_set_headers X-Frame-Options "SAMEORIGIN";
	#more_set_headers X-XSS-Protection "1; mode=block";
	#more_set_headers X-Robots-Tag none;
	#more_set_headers X-Download-Options noopen;
	#more_set_headers X-Permitted-Cross-Domain-Policies none;

Fixes it... although this is probably a better (more secure) solution.

[ashledombos]

Was it happening with self signed certificate or LE?

[arthurlutz]

@ashledombos with LE

[ashledombos]

@arthurlutz it's only the line
#more_set_headers X-XSS-Protection "1; mode=block";
which is blocking (which is normal, it's ignored by Firefox)

This line is useless for modern browsers, it only helps to protect older web browers (see here https://code.i-harness.com/en/docs/http/headers/x-xss-protection )

You should be able to uncomment other headers.

[DaffyDuke]

@arthurlutz it's only the line
#more_set_headers X-XSS-Protection "1; mode=block";
which is blocking (which is normal, it's ignored by Firefox)

This line is useless for modern browsers, it only helps to protect older web browers (see here https://code.i-harness.com/en/docs/http/headers/x-xss-protection )

You should be able to uncomment other headers.

exact : approved on my own instance.

[kay0u]

Hi, this PR should fix this issue.

Thank you for your report!