Handle "self" link protocol when proxied

[MichaelBoselowitz]

I currently have json-api setup behind a Nginx proxy. The proxy sets up a SSL tunnel. All the clients speak only over HTTPS, but everything behind the proxy is only HTTP.

Self links derive their protocol from the incoming request protocol only. The simple fix is to use the traditional X-Forwarded-Proto header instead (if set).

There is probably a better way to handle this, but I'd like to get your thoughts before I post a PR. I just change this line to this:

it.uri = (req.get('X-Forwarded-Proto') || req.protocol) + "://" + req.get("Host") + req.originalUrl;

[ethanresnick]

Good catch!

I've also used this library behind a proxy, and I think I solved this problem by setting express' trust proxy setting to true. IIRC, that then updates req.protocol to uses the value from X-Forwarded-Proto.

Is there some reason not to solve this with trust proxy? (e.g. some security concern I don't know about?) If so, we can talk about other solutions. Otherwise, I'd just use that switch :)

[MichaelBoselowitz]

I didn't know that option existed! This is exactly what I wanted!

That option certainly feels like the proper way to handle this case. I cannot think of any issues with using it (the API is completely isolated behind the proxy). As you may be able to discern, I've never used Node/Express behind a proxy before.

Thanks for the super quick responses to my issues! This is an extremely helpful library, I really appreciate your work. Let me know if I can contribute in any way besides spamming up the issues section. :)

[ethanresnick]

I'm glad that worked, and that the library's been useful to yiu! Also, thanks so much for your offer to contribute; your help would certainly be appreciated! Are there any open issues you might want to take a stab at?

[MichaelBoselowitz]

#17 looks like it would be very helpful to me in the near future. When I start the next phase of my project, I'll do some exploring into that issue and see what I can come up with.

[ethanresnick]

Awesome! Thanks Michael!