[Bug] Domain redirection can run before HTTP-to-HTTPS redirection, causing HSTS Preload validation to fail

Contact Information

awordsgg@outlook.com

1Panel Version

v2.3.0

Problem Description

When a root domain has both HTTP-to-HTTPS redirection and a 301 redirect to its www subdomain enabled, the domain redirect can execute first. This causes HSTS Preload validation to report “HTTP redirects to www first”.

The behavior depends on the order of the generated Nginx directives. The current configuration generation logic does not ensure that HTTP-to-HTTPS redirection runs before domain redirection.

Steps to Reproduce

1. Create a website for a root domain, such as example.com, and configure a valid HTTPS certificate.
2. Add a 301 domain redirect from example.com to https://www.example.com.
3. Enable HTTP-to-HTTPS redirection.
4. Check whether the generated website configuration places the redirect/*.conf include before the HTTP-to-HTTPS rule.
5. Inspect the first HTTP response using: curl -I http://example.com
6. Check the domain at https://hstspreload.org/.

The expected correct result

HTTP requests should first redirect to HTTPS on the same hostname, then redirect to the www subdomain:

http://example.com → https://example.com → https://www.example.com

This order should remain consistent regardless of which feature is enabled first.

HSTS Preload explicitly requires HTTP-to-HTTPS redirection on the same host when port 80 is available:
https://hstspreload.org/

Related log output

Additional Information

Source inspection indicates the following:

• OperateRedirect() in agent/app/service/website.go generates a host-based conditional containing return 301 and includes it through redirect/*.conf.
• AddHTTP2HTTPS() in agent/utils/nginx/components/server.go generates a scheme-based conditional that returns a 301 redirect to https://$host$request_uri, with a port suffix when necessary.
• UpdateDirective() and UpdateDirectiveBySecondKey() update existing directives in place or append new directives. They do not enforce HTTP-to-HTTPS redirection before the domain redirect include.

Nginx executes server-level rewrite module directives sequentially. If the domain redirect returns a response first, the later HTTP-to-HTTPS rule is not executed:
https://nginx.org/en/docs/http/ngx_http_rewrite_module.html

A possible fix is to ensure that HTTP-to-HTTPS redirection precedes domain redirects, covering both enablement orders and disabling/re-enabling either feature.