Security Warning - where did that hail from

SYSTEM INFORMATION
OS type and version Ubuntu Linux 22.04.3
Webmin version 2.105
Usermin version 2.005
Virtualmin version 7.9.0
Theme version 21.09.5
Package updates All installed packages are up to date

First time I’ve seen this!
Selected VS then Virtualmin -> Web Configuration -> Preview Website

Yesterday this opened the website in browser but today it produced this:

Nothing was done overnight. If I go to the website url directly in the browser it opens correctly.

PC = Windows 10
Browser = Chrome

Hello,

Your browser should set a referer. If it doesn’t, this warning will be shown. To fix it, close existing preview window, and re-open it over again by clicking Preview Website link from the navigation menu.

Hmm, now I get a 403 Forbidden

You should try a new tab or a new browser — issues like this are often fixed by force-reloading the browser’s page.

It always opens in a new tab in Chrome

Tried Mozilla Firefox and Brave and Tor
all gave the same result - a “403 Forbidden” in the tab next to the one with Virtualmin logged in as ‘root’

The interesting thing is that preview Website works fine for other VS on this VM except for those that are redirected which gives a “302 Found” which is sort of to be expected - well not really because it redirects correctly if I simply enter the domain.

Even worse this morning:
405

the site was working yesterday a link on the site that yesterday worked now gives a 405.
But if the linked url is entered direct in a new tab it works - this sadly remind me of Apache nonsense but this is a nginx server.

BTW this is the same VM that still has redirecting issues

I don’t know about nginx but it sounds like nginx is misconfigured i found https://stackoverflow.com/questions/24415376/post-request-not-allowed-405-not-allowed-nginx-even-with-headers-included maybe this will help idk

I tend to agree - I put the nginx conf file details on that linked topic.

That stackoverflow topic refers to proxy pass (which is not enabled on this VS, neither is redirecting - yet I feel that is the root of the problem here) also it is worth noting the website (here) is a simple static page with links to other static pages and no POST requests - they are also all PHP pages.

(other VS that do seem to be working OK are all Node apps) many of those also have web redirects. one user owns 14 domain names that are all redirected to a single domain that works.

This is a relatively new user with an experimental domain.

I am almost tempted to delete the VS and start again, even to the point of a separate dedicated VM.

Nginx is good for static web content but not quite so good as apache at delivering dynamic content (from what I have read) just a thought perhaps the php code is sending a post to another file in the php app and nginx is getting a bit confused ? TBF I only use apache for the reason of it’s ability to handle dynamic requests better and of course the end user allowed the ability to add directives to .htaccess and not affect the whole server … maybe I need to spin up something running nginx and see if I can crash it with 405 errors

I have not found that to be the case.
I have several sites all on Nginx all using Nodejs apps - most of which are dynamic. (and pretty much aggressively so)

None of my VS use Apache and I cannot find any .htaccess files anywhere in this VS so it is not that - I have been in and had a quick look at the code it is a very simple index.html page with links to other sub directories that each have a index.php file.

This VS does have roundcube installed (since initial set up) and phpMyAdmin (since 21 Jan when I posted a problem with finding that script installer) both are running just fine as far as I can tell so unrelated.

I have even added a test directory and html code of my own with some event scripts and that works fine when accessed directly.