groove/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-07-21 16:51:42 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Update x-forwarded-proto to check comma separated value

Browse source
This commit is contained in:
advplyr 2026-07-20 17:06:21 -05:00
parent 8d9db8d103
commit b93c3133a9
2 changed files with 13 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

13
server/utils/requestUtils.js
View file

@ -1,12 +1,21 @@
/**
* Whether the request was made over HTTPS.
* Uses Express `req.secure` and a strict `x-forwarded-proto === 'https'` check.
* Uses Express `req.secure` and `x-forwarded-proto`
*
* @param {import('express').Request} req
* @returns {boolean}
*/
function isRequestSecure(req) {
return req.secure || req.get('x-forwarded-proto') === 'https'
if (req.secure) return true
const xfp = (req.get('x-forwarded-proto') || '').toLowerCase()
// Nginx Proxy Manager sends "http, https"; see https://github.com/advplyr/audiobookshelf/pull/4635
return (
xfp === 'https' ||
xfp
.split(',')
.map((s) => s.trim())
.includes('https')
)
}
/**

4
test/server/utils/requestUtils.test.js
View file

@ -19,10 +19,10 @@ describe('requestUtils', () => {
expect(isRequestSecure(mockReq({ secure: false }))).to.equal(false)
})
it('isRequestSecure uses strict x-forwarded-proto check', () => {
it('isRequestSecure uses x-forwarded-proto', () => {
expect(isRequestSecure(mockReq({ xForwardedProto: 'https' }))).to.equal(true)
expect(isRequestSecure(mockReq({ xForwardedProto: 'http' }))).to.equal(false)
expect(isRequestSecure(mockReq({ xForwardedProto: 'http, https' }))).to.equal(false)
expect(isRequestSecure(mockReq({ xForwardedProto: 'http, https' }))).to.equal(true)
})
it('getRequestProtocol returns https or http', () => {