I have a TypeScript site that's deployed on a Ubuntu server. When the admin with the URL https://www.example.com/admin, enter my credentials and click Enter, I get a screen that's blank except for `Cross-site POST form submissions are forbidden`.
My nginx config is:
# -----------------------------
# Rate Limiting Zones
# -----------------------------
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
limit_req_zone $binary_remote_addr zone=general:10m rate=30r/s;

# -----------------------------
# Upstream (Astro SSR)
# -----------------------------
upstream wedding_backend {
 server 127.0.0.1:4321;
 keepalive 64;
}

# ============================================================
# 1️⃣ HTTPS — bare domain → redirect to www
# ============================================================
server {
 listen 443 ssl;
 listen [::]:443 ssl ipv6only=on;

 server_name example.com;

 return 301 https://www.example.com$request_uri;

 ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
 ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
 include /etc/letsencrypt/options-ssl-nginx.conf;
 ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}

# ============================================================
# 2️⃣ HTTPS — main server for www
# ============================================================
server {
 listen 443 ssl;
 listen [::]:443 ssl ipv6only=on;

 server_name www.example.com;

 root /var/www/wedding-invitation/dist/client;

 # -----------------------------
 # Security Headers
 # -----------------------------
 add_header X-Frame-Options "SAMEORIGIN" always;
 add_header X-Content-Type-Options "nosniff" always;
 add_header X-XSS-Protection "1; mode=block" always;
 add_header Referrer-Policy "no-referrer-when-downgrade" always;

 # -----------------------------
 # Gzip Compression
 # -----------------------------
 gzip on;
 gzip_vary on;
 gzip_min_length 1024;
 gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml+rss application/json image/svg+xml;

 # -----------------------------
 # Static Astro assets
 # -----------------------------
 location /_astro/ {
 proxy_pass http://wedding_backend;
 proxy_http_version 1.1;
 proxy_set_header Host $host;
 proxy_set_header Upgrade $http_upgrade;
 proxy_set_header Connection 'upgrade';
 proxy_cache_bypass $http_upgrade;

 expires 1y;
 add_header Cache-Control "public, max-age=31536000, immutable";
 access_log off;
 }

 # -----------------------------
 # Images & Fonts
 # -----------------------------
 location ~* \.(jpg|jpeg|png|gif|ico|svg|webp|woff|woff2|ttf|eot)$ {
 proxy_pass http://wedding_backend;
 proxy_http_version 1.1;
 proxy_set_header Host $host;

 expires 30d;
 add_header Cache-Control "public, max-age=2592000";
 access_log off;
 }

 # -----------------------------
 # API (rate limited)
 # -----------------------------
 location ~ ^/api/(rsvp|wishes) {
 limit_req zone=api burst=5 nodelay;

 proxy_pass http://wedding_backend;
 proxy_http_version 1.1;

 proxy_set_header Host $host;
 proxy_set_header X-Forwarded-Host $host;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-Proto $scheme;

 proxy_set_header Upgrade $http_upgrade;
 proxy_set_header Connection 'upgrade';
 proxy_cache_bypass $http_upgrade;

 add_header Cache-Control "no-cache, no-store, must-revalidate";
 }

 # -----------------------------
 # Admin Panel
 # -----------------------------
 location /admin {
 limit_req zone=api burst=3 nodelay;

 proxy_pass http://wedding_backend;
 proxy_http_version 1.1;

 proxy_set_header Host $host;
 proxy_set_header X-Forwarded-Host $host;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-Proto $scheme;

 proxy_set_header Upgrade $http_upgrade;
 proxy_set_header Connection 'upgrade';
 proxy_cache_bypass $http_upgrade;

 add_header Cache-Control "no-cache, no-store, must-revalidate";
 }

 # -----------------------------
 # Main SSR Application
 # -----------------------------
 location / {
 limit_req zone=general burst=10 nodelay;

 proxy_pass http://wedding_backend;
 proxy_http_version 1.1;

 proxy_set_header Host $host;
 proxy_set_header X-Forwarded-Host $host;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-Proto $scheme;

 proxy_set_header Upgrade $http_upgrade;
 proxy_set_header Connection 'upgrade';
 proxy_cache_bypass $http_upgrade;

 add_header Cache-Control "public, max-age=300";
 }

 # SSL (Certbot)
 ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
 ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
 include /etc/letsencrypt/options-ssl-nginx.conf;
 ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}

# ============================================================
# 3️⃣ HTTP — redirect everything to HTTPS www
# ============================================================
server {
 listen 80;
 listen [::]:80;

 server_name example.com www.example.com;

 return 301 https://www.example.com$request_uri;
}
Is it possibly the issue?
Recent Questions - Server Fault

Message History

Delivery option(s)
