The route proxy tells a backend the request was HTTPS, and for which name #245

Merged
mesh-admin merged 1 commits from fix/the-route-proxy-says-the-request-was-https into main 2026-10-03 20:23:03 +00:00
Contributor

Found making the Go SDK installable: go get git.novox.be/novox/mesh-sdk/go is refused because Gitea's go-import tag names http://git.novox.be/… — Gitea's ROOT_URL is https, but 1.27 derives public URLs from the request, and the route proxy (httputil.NewSingleHostReverseProxy) forwards only X-Forwarded-For. Verified: with X-Forwarded-Proto: https Gitea answers https://…. The proxy now uses Rewrite with SetXForwarded() (Proto, Host, For from the request it received) and keeps the inbound Host header as before. Every backend that writes its own absolute URLs benefits. Test added.

Found making the Go SDK installable: `go get git.novox.be/novox/mesh-sdk/go` is refused because Gitea's go-import tag names `http://git.novox.be/…` — Gitea's ROOT_URL is https, but 1.27 derives public URLs from the request, and the route proxy (`httputil.NewSingleHostReverseProxy`) forwards only `X-Forwarded-For`. Verified: with `X-Forwarded-Proto: https` Gitea answers `https://…`. The proxy now uses `Rewrite` with `SetXForwarded()` (Proto, Host, For from the request it received) and keeps the inbound Host header as before. Every backend that writes its own absolute URLs benefits. Test added.
mesh-admin added 1 commit 2026-10-03 20:22:58 +00:00
NewSingleHostReverseProxy sets only X-Forwarded-For, so a backend that writes its own addresses saw
the plain hop from the proxy: Gitea's Go import tag named an http clone URL and go get refused the
SDK's module path. The proxy now sets X-Forwarded-Proto, -Host and -For from the request it received,
and keeps the Host header as it was.
mesh-admin merged commit 473376259b into main 2026-10-03 20:23:03 +00:00
mesh-admin deleted branch fix/the-route-proxy-says-the-request-was-https 2026-10-03 20:23:03 +00:00
Sign in to join this conversation.
No Reviewers
No labels
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-controller#245