update host header to fix CSRF issues

Author: aptalca

README.md

@@ -267,6 +267,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
 
 ## Versions
 
+* **23.10.19:** - Update Host header in `proxy.conf` to fix CSRF issues.
 * **12.10.19:** - Add linode dns validation plugin.
 * **23.09.19:** - Move GeoIP2 db to /config to make it persistent.
 * **14.08.19:** - Add inwx dns validation plugin.

readme-vars.yml

@@ -126,6 +126,7 @@ app_setup_nginx_reverse_proxy_block: ""
 
 # changelog
 changelogs:
+  - { date: "23.10.19:", desc: "Update Host header in `proxy.conf` to fix CSRF issues." }
   - { date: "12.10.19:", desc: "Add linode dns validation plugin." }
   - { date: "23.09.19:", desc: "Move GeoIP2 db to /config to make it persistent." }
   - { date: "14.08.19:", desc: "Add inwx dns validation plugin." }

root/defaults/proxy.conf

@@ -1,4 +1,4 @@
-## Version 2019/08/11 - Changelog: https://github.com/linuxserver/docker-letsencrypt/commits/master/root/defaults/proxy.conf
+## Version 2019/10/23 - Changelog: https://github.com/linuxserver/docker-letsencrypt/commits/master/root/defaults/proxy.conf
 
 client_body_buffer_size 128k;
 
@@ -15,7 +15,7 @@ proxy_connect_timeout 240;
 proxy_set_header Early-Data $ssl_early_data;
 
 # Basic Proxy Config
-proxy_set_header Host $host:$server_port;
+proxy_set_header Host $host;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-Proto https;