nginx plugin -> security header UI not working since 26.7

Started by Timeraider, July 21, 2026, 10:44:58 AM

Previous topic - Next topic
nginx plugin -> security header UI not working since 26.7
So under the Nginx plugin -> configuration -> http(s), you have an option for Security headers.
Once I try editing any of them, the UI acts weird and while it shows the tabs it refuses to show any content.
Makes it impossible to update it.
This kinda blocks me from fixing one of my sites XD

Current OPNSense hardware: Protectli VP4650

July 21, 2026, 11:38:20 AM #1 Last Edit: July 21, 2026, 12:03:32 PM by Timeraider
No errors in the logs of opnsense btw.
There is an HTML page error however im not sure if that causes anything or is related in any way.
Blocked aria-hidden on an element because its descendant retained focus. The focus must not be hidden from assistive technology users. Avoid using aria-hidden on a focused element or its ancestor. Consider using the inert attribute instead, which will also prevent focus. For more details, see the aria-hidden section of the WAI-ARIA specification at https://w3c.github.io/aria/#aria-hidden.
Element with focus: <div.modal fade modal_draggable in#security_headersdlg>
Ancestor with aria-hidden: <div.modal fade modal_draggable in#security_headersdlg>
Current OPNSense hardware: Protectli VP4650

Hi Timeraider, I've reported this issue on github https://github.com/opnsense/core/issues/10546.
Another issue reported earlier that can be related is https://github.com/opnsense/core/issues/10535. This has been already addressed but Franco reopened it because there is a chance that it is also related to this problem.

Quote from: muchacha_grande on July 21, 2026, 02:26:08 PMHi Timeraider, I've reported this issue on github https://github.com/opnsense/core/issues/10546.
Another issue reported earlier that can be related is https://github.com/opnsense/core/issues/10535. This has been already addressed but Franco reopened it because there is a chance that it is also related to this problem.

Ah, I missed that issue. Guess ill wait it out and keep an eye on that one :P
I can luckily sort of work around it now as I did have a security header profile with everything allowed so if actions get blocked I can still switch my site to that before executing the action but I prefer to be able to edit the existing ones ofc. ;D
Current OPNSense hardware: Protectli VP4650