refactor(request)!: make x-forwarded-proto trust opt-in#1461
Merged
Conversation
📝 WalkthroughWalkthroughThe change makes ChangesRequest protocol forwarding
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
getRequestProtocol trusted the x-forwarded-proto header by default,
while its siblings getRequestHost (xForwardedHost) and getRequestIP
(xForwardedFor) default forwarded-header trust to false. A directly
exposed app would believe a client-spoofed https, affecting
secure-cookie decisions, canonical/absolute URLs, and cache keys.
The header is now honored only with { xForwardedProto: true }.
BREAKING CHANGE: getRequestProtocol/getRequestURL ignore
x-forwarded-proto unless xForwardedProto: true is passed.
Co-Authored-By: Claude Fable 5 <[email protected]>
pi0x
force-pushed
the
feat/opt-in-x-forwarded-proto
branch
from
July 14, 2026 09:31
28be1cf to
b713584
Compare
pi0
approved these changes
Jul 14, 2026
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@MIGRATION.md`:
- Around line 142-144: Update the adjacent alert formatting in MIGRATION.md to
resolve markdownlint MD028 while preserving the separate rendering of the
[!IMPORTANT] and [!NOTE] blocks. Apply a targeted suppression or equivalent
structure around the alert boundary, without merging the alerts or changing
their content.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 2f8fcd92-e79c-4636-b5dd-dfc51ee2c6f7
📒 Files selected for processing (4)
MIGRATION.mddocs/2.utils/1.request.mdsrc/utils/request.tstest/unit/request.test.ts
🚧 Files skipped from review as they are similar to previous changes (3)
- docs/2.utils/1.request.md
- test/unit/request.test.ts
- src/utils/request.ts
pi0
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
getRequestProtocoltrusts thex-forwarded-protoheader by default, while its siblingsgetRequestHost(xForwardedHost) andgetRequestIP(xForwardedFor) default forwarded-header trust tofalse. A directly-exposed app believes a client-spoofedhttps— affecting secure-cookie decisions, canonical/absolute URLs, and cache keys — and the inconsistency between the three siblings is surprising.What
getRequestProtocol(andgetRequestURL, which composes it) now honorx-forwarded-protoonly when explicitly enabled with{ xForwardedProto: true }.docs/2.utils/1.request.mdupdated; MIGRATION.md gains an[!IMPORTANT]note.BREAKING CHANGE: apps behind a trusted reverse proxy/CDN that rely on
x-forwarded-protomust now pass{ xForwardedProto: true }.Tests
New regression test asserts a spoofed
x-forwarded-proto: httpsis ignored by default (failed before the fix); existing honored-header tests flipped to explicit opt-in. Full suite green (1441 passed).🤖 Generated with Claude Code
Summary by CodeRabbit
x-forwarded-protoby default.{ xForwardedProto: true }) for trusted reverse proxy/CDN setups.x-forwarded-protoentries (including handling values with spaces).MIGRATION.mdand request docs to reflect the newx-forwarded-protoopt-in behavior and security considerations.