From 8baa0fc84534695d0cebc0652d8b0e9f3107c804 Mon Sep 17 00:00:00 2001 From: jossephus Date: Wed, 14 Oct 2026 09:00:09 +0300 Subject: [PATCH] Self-host: pass the proxy's X-Forwarded-Proto through to the product The Go host proxies to workerd over plain http, and ReverseProxy's Rewrite drops X-Forwarded-Proto, so the product saw http:// request URLs even when browsers used https://. The dashboard batch endpoint compares Origin with that URL, so behind an HTTPS proxy every POST /api/dashboard/batch answered 403 and dashboard panels showed "Unable to complete this request". The Go host now passes the proxy's X-Forwarded-Proto (http or https) through. --- apps/hosted/self-host/native/main.go | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/apps/hosted/self-host/native/main.go b/apps/hosted/self-host/native/main.go index eec3be123b..10524e3783 100644 --- a/apps/hosted/self-host/native/main.go +++ b/apps/hosted/self-host/native/main.go @@ -720,6 +720,13 @@ func serve(mode string) error { defer stopMotel() proxy := productProxy(filepath.Join(temporary, "product.sock"), workerdIdleTimeout) + rewrite := proxy.Rewrite + proxy.Rewrite = func(request *httputil.ProxyRequest) { + rewrite(request) + if proto := request.In.Header.Get("X-Forwarded-Proto"); proto == "https" || proto == "http" { + request.Out.Header.Set("X-Forwarded-Proto", proto) + } + } publicListener, err := net.Listen("tcp", net.JoinHostPort(setting("HOST", "0.0.0.0"), port)) if err != nil { command.Process.Kill()