Skip to content

🐛 fix(web-server): use X-Forwarded-Proto header for confirmation link scheme 🚑 #9026

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
giancarloromeo merged 3 commits into from
Apr 14, 2026
Merged

🐛 fix(web-server): use X-Forwarded-Proto header for confirmation link scheme 🚑 #9026

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0d60efe
fix
giancarloromeo Apr 14, 2026
0cab49b
Merge branch 'master' into fix/confirmation-link-https-scheme
giancarloromeo Apr 14, 2026
4bd6d47
Merge branch 'master' into fix/confirmation-link-https-scheme
odeimaiz Apr 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion services/web/server/src/simcore_service_webserver/login/_confirmation_web.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
from urllib.parse import quote

from aiohttp import web
from servicelib.common_headers import X_FORWARDED_PROTO
from yarl import URL

from simcore_service_webserver.login._application_keys import (
Expand All @@ -26,7 +27,10 @@ def _url_for_confirmation(app: web.Application, code: str) -> URL:
def make_confirmation_link(request: web.Request, code: str) -> str:
assert code # nosec
link = _url_for_confirmation(request.app, code=code)
return f"{request.scheme}://{request.host}{link}"
# Custom header by traefik. See labels in docker-compose as:
# - traefik.http.middlewares.${SWARM_STACK_NAME_NO_HYPHEN}_sslheader.headers.customrequestheaders.X-Forwarded-Proto=http # noqa: E501
scheme = request.headers.get(X_FORWARDED_PROTO, request.scheme)
Comment thread
giancarloromeo marked this conversation as resolved.
return f"{scheme}://{request.host}{link}"


@ensure_single_setup(__name__, logger=_logger)
Expand Down
10 changes: 10 additions & 0 deletions services/web/server/tests/unit/with_dbs/03/login/test_login_confirmation_service.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,16 @@ async def mock_handler(request: web.Request):
assert confirmation_link.startswith("https://example.com/auth/confirmation/")
assert confirmation.code in confirmation_link

# Step 5: Verify X-Forwarded-Proto header is respected
request_behind_proxy = make_mocked_request(
"GET",
"http://example.com/auth/confirmation/{code}",
app=app,
headers={"Host": "example.com", "X-Forwarded-Proto": "https"},
)
confirmation_link_via_proxy = _confirmation_web.make_confirmation_link(request_behind_proxy, confirmation.code)
assert confirmation_link_via_proxy.startswith("https://example.com/auth/confirmation/")


async def test_expired_confirmation_token(
confirmation_service: ConfirmationService,
Expand Down
Loading