From c9f1437860df0ae73b3ee4a8c5c9fb02d29dfc2a Mon Sep 17 00:00:00 2001 From: cesnimda Date: Fri, 10 Jul 2026 22:03:23 +0200 Subject: [PATCH] fix(proxy): honor upstream X-Forwarded-Proto so OAuth redirect is https behind traefik The SPA nginx overwrote the reverse proxy's X-Forwarded-Proto with $scheme (http on the traefik->frontend hop), so the API built http:// OAuth redirects that Google rejects. Map the incoming proto through (fallback to $scheme for direct access). Needed for login via https://inboxintel.cesnimda.uk behind traefik. Co-Authored-By: Claude Opus 4.8 --- frontend/nginx.conf | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/frontend/nginx.conf b/frontend/nginx.conf index 938d8d0..082f5a3 100644 --- a/frontend/nginx.conf +++ b/frontend/nginx.conf @@ -1,3 +1,11 @@ +# Honor a reverse proxy's X-Forwarded-Proto (e.g. traefik terminating TLS) so the API sees +# https and builds https OAuth redirects; fall back to the connection scheme for direct access. +map $http_x_forwarded_proto $fwd_proto { + default $scheme; + https https; + http http; +} + server { listen 80; server_name _; @@ -27,7 +35,7 @@ server { proxy_pass http://api:8080; proxy_set_header Host $http_host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Proto $fwd_proto; proxy_set_header X-Forwarded-Host $http_host; proxy_set_header Cookie $http_cookie; } @@ -38,7 +46,7 @@ server { proxy_pass http://api:8080; proxy_set_header Host $http_host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Proto $fwd_proto; proxy_set_header X-Forwarded-Host $http_host; proxy_set_header Cookie $http_cookie; }