But the security scan is still reporting the same problem. The scan report ends with - "technical details : sent HTTP2 request with 20 SETTINGS and received a valid response"
I do have http2 enabled, and need it to stay enabled.
Can someone please point me in the right direction about how to fix this. I have a few questions.
Can I disable that "20 SETTINGS" request somehow?
Will that mess up my http2 connections?
Is there some other solution?
Should I try to update to mainline?
Here is the output of my nginx -V
nginx version: nginx/1.16.1 built by clang 6.0.0 (tags/RELEASE_600/final 326565) (based on LLVM 6.0.0) built with OpenSSL 1.0.2o-freebsd 27 Mar 2018 TLS SNI support enabled configure arguments: --prefix=/usr/local/nginx --with-http_ssl_module --with-http_v2_module