nullnet-proxy implements no upstream_request_filter, so requests are forwarded verbatim: the origin sees the proxy's IP as the client and sees plain HTTP even when the browser used HTTPS.
Apps that rate-limit or authorise by client IP, log real client addresses, or build absolute URLs from the request scheme all misbehave once they move behind nullnet.
Fix: add X-Forwarded-For, X-Forwarded-Proto and X-Forwarded-Host in an upstream_request_filter.
The client IP and the listener's TLS flag are already at hand in the proxy.
nullnet-proxyimplements noupstream_request_filter, so requests are forwarded verbatim: the origin sees the proxy's IP as the client and sees plain HTTP even when the browser used HTTPS.Apps that rate-limit or authorise by client IP, log real client addresses, or build absolute URLs from the request scheme all misbehave once they move behind nullnet.
Fix: add
X-Forwarded-For,X-Forwarded-ProtoandX-Forwarded-Hostin anupstream_request_filter.The client IP and the listener's TLS flag are already at hand in the proxy.