sneak
3939cd87d4
All checks were successful
check / check (push) Successful in 3m10s
The source detail page assigned the raw X-Forwarded-Proto value straight into the URL scheme, so `HTTPS` rendered `HTTPS://host`, a chained proxy's `https, http` rendered `https, http://host`, and any token at all landed there verbatim. That URL is what the operator pastes into GitHub or Stripe, so a malformed scheme means the webhook never arrives. A present header also overwrote what a direct TLS connection had already proved. The scheme now comes from reqtls.IsTLS, the shared predicate, so it is only ever http or https and all three TLS-decision sites agree. The host stays as the request sent it: nothing in the configuration names a canonical hostname to validate against, and constraining it would break the deployments behind a proxy on a non-default port or an IPv6 literal. A comment marks why the unvalidated value is inert where it is rendered.
6.6 KiB
6.6 KiB