cesnimda/Inboxintel
1
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix(proxy): honor upstream X-Forwarded-Proto so OAuth redirect is https behind traefik
CI / backend (pull_request) Has been cancelled
Details
CI / frontend (pull_request) Has been cancelled
Details
CI / format (pull_request) Has been cancelled
Details
CI / db-tests (pull_request) Has been cancelled
Details
Security / secrets (pull_request) Successful in 6s
Details
Security / dependencies (pull_request) Successful in 1m12s
Details
Security / sast (pull_request) Failing after 5s
Details

Browse Source 
The SPA nginx overwrote the reverse proxy's X-Forwarded-Proto with $scheme (http on the
traefik->frontend hop), so the API built http:// OAuth redirects that Google rejects. Map
the incoming proto through (fallback to $scheme for direct access). Needed for login via
https://inboxintel.cesnimda.uk behind traefik.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
cesnimda
2026-07-10 22:03:23 +02:00
parent eee7ef6055
commit c9f1437860
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/nginx.conf
+10 -2
View File
@@ -1,3 +1,11 @@
# Honor a reverse proxy's X-Forwarded-Proto (e.g. traefik terminating TLS) so the API sees
# https and builds https OAuth redirects; fall back to the connection scheme for direct access.
map $http_x_forwarded_proto $fwd_proto {
default $scheme;
https https;
http http;
}
server { server {
listen 80; listen 80;
server_name _; server_name _;
@@ -27,7 +35,7 @@ server {
proxy_pass http://api:8080; proxy_pass http://api:8080;
proxy_set_header Host $http_host; proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Proto $fwd_proto;
proxy_set_header X-Forwarded-Host $http_host; proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header Cookie $http_cookie; proxy_set_header Cookie $http_cookie;
} }
@@ -38,7 +46,7 @@ server {
proxy_pass http://api:8080; proxy_pass http://api:8080;
proxy_set_header Host $http_host; proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Proto $fwd_proto;
proxy_set_header X-Forwarded-Host $http_host; proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header Cookie $http_cookie; proxy_set_header Cookie $http_cookie;
} }