From 25363adde9aedc69067dc5df6ec1e15116bace4a Mon Sep 17 00:00:00 2001 From: jeremy bayse Date: Sun, 26 Jul 2026 11:43:29 +0200 Subject: [PATCH] Trust reverse proxy headers to fix mixed-content asset URLs Behind the prod TLS-terminating proxy, Laravel only saw the internal HTTP hop and generated http:// URLs for Vite assets, which browsers block as mixed content on an https:// page (suivicpt.trankil.net). Configured trustProxies in bootstrap/app.php to honor X-Forwarded-* headers, defaulting to trust any upstream (TRUSTED_PROXIES env var to restrict to a specific IP if the app is ever reachable directly over HTTP). .env.production reference updated with the real APP_URL and the new TRUSTED_PROXIES setting. Co-Authored-By: Claude Sonnet 5 --- bootstrap/app.php | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/bootstrap/app.php b/bootstrap/app.php index 8cf08d4..c0b4954 100644 --- a/bootstrap/app.php +++ b/bootstrap/app.php @@ -4,6 +4,7 @@ use App\Http\Middleware\EnsureHouseholdSelected; use Illuminate\Foundation\Application; use Illuminate\Foundation\Configuration\Exceptions; use Illuminate\Foundation\Configuration\Middleware; +use Illuminate\Http\Request; return Application::configure(basePath: dirname(__DIR__)) ->withRouting( @@ -15,6 +16,20 @@ return Application::configure(basePath: dirname(__DIR__)) $middleware->alias([ 'household' => EnsureHouseholdSelected::class, ]); + + // Behind a reverse proxy (nginx/Caddy) terminating TLS, Laravel only + // sees the internal HTTP hop unless it trusts X-Forwarded-* headers — + // otherwise every generated URL (including @vite asset URLs) comes + // back as http:// and gets blocked as mixed content on an https:// page. + $trustedProxies = env('TRUSTED_PROXIES', '*'); + + $middleware->trustProxies( + at: $trustedProxies === '*' ? '*' : array_filter(explode(',', (string) $trustedProxies)), + headers: Request::HEADER_X_FORWARDED_FOR + | Request::HEADER_X_FORWARDED_HOST + | Request::HEADER_X_FORWARDED_PORT + | Request::HEADER_X_FORWARDED_PROTO, + ); }) ->withExceptions(function (Exceptions $exceptions) { //