groove/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-07-24 18:21:37 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

Update x-forwarded-proto to check comma separated value

Browse source
This commit is contained in:
advplyr 2026-07-20 17:06:21 -05:00
parent 8d9db8d103
commit b93c3133a9
2 changed files with 13 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

13
server/utils/requestUtils.js
View file

@ -1,12 +1,21 @@
/** /**
* Whether the request was made over HTTPS. * Whether the request was made over HTTPS.
* Uses Express `req.secure` and a strict `x-forwarded-proto === 'https'` check. * Uses Express `req.secure` and `x-forwarded-proto`
* *
* @param {import('express').Request} req * @param {import('express').Request} req
* @returns {boolean} * @returns {boolean}
*/ */
function isRequestSecure(req) { function isRequestSecure(req) {
return req.secure || req.get('x-forwarded-proto') === 'https' if (req.secure) return true
const xfp = (req.get('x-forwarded-proto') || '').toLowerCase()
// Nginx Proxy Manager sends "http, https"; see https://github.com/advplyr/audiobookshelf/pull/4635
return (
xfp === 'https' ||
xfp
.split(',')
.map((s) => s.trim())
.includes('https')
)
} }
/** /**

4
test/server/utils/requestUtils.test.js
View file

@ -19,10 +19,10 @@ describe('requestUtils', () => {
expect(isRequestSecure(mockReq({ secure: false }))).to.equal(false) expect(isRequestSecure(mockReq({ secure: false }))).to.equal(false)
}) })
it('isRequestSecure uses strict x-forwarded-proto check', () => { it('isRequestSecure uses x-forwarded-proto', () => {
expect(isRequestSecure(mockReq({ xForwardedProto: 'https' }))).to.equal(true) expect(isRequestSecure(mockReq({ xForwardedProto: 'https' }))).to.equal(true)
expect(isRequestSecure(mockReq({ xForwardedProto: 'http' }))).to.equal(false) expect(isRequestSecure(mockReq({ xForwardedProto: 'http' }))).to.equal(false)
expect(isRequestSecure(mockReq({ xForwardedProto: 'http, https' }))).to.equal(false) expect(isRequestSecure(mockReq({ xForwardedProto: 'http, https' }))).to.equal(true)
}) })
it('getRequestProtocol returns https or http', () => { it('getRequestProtocol returns https or http', () => {