Improved https recognition behind load balancer (#221)

nette · Mar 18, 2023 · 792f6b4 · 792f6b4
1 parent 613d8cf
commit 792f6b4
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 5 deletions.
diff --git a/src/Http/RequestFactory.php b/src/Http/RequestFactory.php
@@ -315,6 +315,11 @@ private function useForwardedProxy(Url $url): ?string
 				: substr($address, 1, strpos($address, ']') - 1); // IPv6
 		}
 
+		if (isset($proxyParams['proto']) && count($proxyParams['proto']) === 1) {
+			$url->setScheme(strcasecmp($proxyParams['proto'][0], 'https') === 0 ? 'https' : 'http');
+			$url->setPort($url->getScheme() === 'https' ? 443 : 80);
+		}
+
 		if (isset($proxyParams['host']) && count($proxyParams['host']) === 1) {
 			$host = $proxyParams['host'][0];
 			$startingDelimiterPosition = strpos($host, '[');
@@ -333,11 +338,6 @@ private function useForwardedProxy(Url $url): ?string
 				}
 			}
 		}
-
-		$scheme = (isset($proxyParams['proto']) && count($proxyParams['proto']) === 1)
-			? $proxyParams['proto'][0]
-			: 'http';
-		$url->setScheme(strcasecmp($scheme, 'https') === 0 ? 'https' : 'http');
 		return $remoteAddr ?? null;
 	}
 

diff --git a/tests/Http/RequestFactory.port.phpt b/tests/Http/RequestFactory.port.phpt
@@ -74,6 +74,10 @@ class RequestFactoryPortTest extends Tester\TestCase
 			[8080, ['HTTP_HOST' => 'localhost', 'SERVER_PORT' => '666', 'HTTP_X_FORWARDED_PORT' => '8080']],
 			[8080, ['SERVER_NAME' => 'localhost', 'SERVER_PORT' => '666', 'HTTP_X_FORWARDED_PORT' => '8080']],
 			[44443, ['HTTPS' => 'on', 'SERVER_NAME' => 'localhost:666', 'HTTP_X_FORWARDED_PORT' => '44443']],
+			[443, ['HTTP_FORWARDED' => 'for=192.168.1.1;host=example.com;proto=https']],
+			[44443, ['HTTP_FORWARDED' => 'for=192.168.1.1;host=example.com:44443;proto=https']],
+			[80, ['HTTP_FORWARDED' => 'for=192.168.1.1;host=example.com;proto=http']],
+			[8080, ['HTTP_FORWARDED' => 'for=192.168.1.1;host=example.com:8080;proto=http']],
 		];
 	}
 }