ahmido/lms
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix mixed content by trusting proxy HTTPS
All checks were successful
Build & Push Docker Image / docker (push) Successful in 1m50s
Details

Browse Source
This commit is contained in:
Ahmed Darrazi 2025-12-18 15:35:51 +01:00
parent c00f58bced
commit 138cf3566b
2 changed files with 7 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
app/Providers/AppServiceProvider.php
View File

@ -66,22 +66,9 @@ class AppServiceProvider extends ServiceProvider
return env('FRONTEND_URL') . '/reset-password?token=' . $token . '&email=' . $user->email; return env('FRONTEND_URL') . '/reset-password?token=' . $token . '&email=' . $user->email;
}); });
// Trust proxies when running behind a reverse proxy (e.g., Docker, nginx) // Force HTTPS URLs in non-local envs to avoid mixed-content issues when TLS is terminated
// This allows Laravel to correctly detect HTTPS when behind a proxy // in front of the app container (e.g. Dokploy/Traefik).
if (config('app.env') !== 'local' || request()->hasHeader('X-Forwarded-Proto')) { if (!$this->app->runningInConsole() && !$this->app->environment('local')) {
request()->setTrustedProxies(
['*'],
\Illuminate\Http\Request::HEADER_X_FORWARDED_FOR |
\Illuminate\Http\Request::HEADER_X_FORWARDED_HOST |
\Illuminate\Http\Request::HEADER_X_FORWARDED_PORT |
\Illuminate\Http\Request::HEADER_X_FORWARDED_PROTO |
\Illuminate\Http\Request::HEADER_X_FORWARDED_PREFIX
);
}
// Force HTTPS scheme for URLs when accessed via HTTPS
// This ensures assets load with the correct protocol
if (request()->header('X-Forwarded-Proto') === 'https' || request()->secure()) {
URL::forceScheme('https'); URL::forceScheme('https');
} }
} }

4
bootstrap/app.php
View File

@ -44,6 +44,10 @@ return Application::configure(basePath: dirname(__DIR__))
\Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class, \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
]); ]);
// Trust reverse proxy headers (X-Forwarded-Proto, etc.) so Laravel generates HTTPS URLs
// correctly when TLS is terminated in front of the container (e.g. Dokploy/Traefik).
$middleware->trustProxies(at: '*');
$middleware->encryptCookies(except: ['appearance']); $middleware->encryptCookies(except: ['appearance']);
$middleware->web(append: [ $middleware->web(append: [