protocol of request mistakingly identified as https in server build with adapter-node

[tylkomat]

Describe the bug

Sending a POST request to a server build with adapter-node fails with a cors error due to a wrong protocol in request.url.

The left side of the check (request.headers.get('origin')) has the correct url, while the right side (url.origin) has https as protocol instead of http, making the check fail (inequality) and resulting in a cors error.

The app works as intended in dev mode.

Reproduction

1. Create a new empty app with a form element and a handler on the server, change the adapter to adapter-node or use this repo for convinience.
2. build and run the server

npm run build
node ./build

3. visit http://127.0.0.1:3000, click into the form element and press enter to submit

Logs

POST http://localhost:3000/
[HTTP/1.1 403 Forbidden 12ms]

Response: Cross-site POST form submissions are forbidden

System Info

System:
    OS: Windows 10 10.0.19044
    CPU: (16) x64 AMD Ryzen 7 3700X 8-Core Processor
    Memory: 3.30 GB / 15.93 GB
  Binaries:
    Node: 18.7.0 - ~\AppData\Local\Volta\tools\image\node\18.7.0\node.EXE
    npm: 8.15.0 - ~\AppData\Local\Volta\tools\image\node\18.7.0\npm.CMD
  Browsers:
    Edge: Spartan (44.19041.1266.0), Chromium (105.0.1343.33)
    Internet Explorer: 11.0.19041.1566
  npmPackages:
    @sveltejs/adapter-node: next => 1.0.0-next.90
    @sveltejs/kit: next => 1.0.0-next.481
    svelte: ^3.44.0 => 3.50.1
    vite: ^3.1.0 => 3.1.0

Severity

serious, but I can work around it

Additional Information

No response

[Conduitry]

This is the intended behavior. There's no reliable way for the production code to know whether it's behind an HTTPS proxy, so it assumes it is behind one, because that's generally the case in production. You can use https://github.com/sveltejs/kit/tree/master/packages/adapter-node#origin-protocol_header-and-host_header to override this.

[tylkomat]

Maybe the readme of adapter-node could be extended to highlight, that the ORIGIN env variable is required if no proxy is used. In testing for example.