CanbiZ (MickLesk) ae3e1deece fix(immich): disable upgrade-insecure-requests CSP directive (#13600) ...

Helmet's useDefaults adds upgrade-insecure-requests to the CSP,
which forces browsers to upgrade all HTTP requests to HTTPS.
Since most LXC users access Immich directly via HTTP, this breaks
the web UI completely (CORS errors, spinning logo).

Patch helmet.json after deploy to explicitly null out the directive,
keeping CSP benefits while allowing HTTP access.

Fixes #13597

2026-04-08 19:47:10 +02:00

17 KiB

Raw Blame History

View Raw