diff options
| author |  Jarred Sumner <jarred@jarredsumner.com>
| 2022-01-02 15:32:47 -0800 |
|---|---|---|
| committer | Jarred Sumner <jarred@jarredsumner.com>
| 2022-01-02 15:32:47 -0800 |
| commit | b17df61043d154e06e290640320a55ec275445d7 (patch) | |
| tree | 263bf3a1404196dae94d3fbc2a9ba50e434029ac /src | |
| parent | 4e0cdf34b6fc1a8c3be5ddb727a08569eefe3353 (diff) | |
| download | bun-b17df61043d154e06e290640320a55ec275445d7.tar.gz bun-b17df61043d154e06e290640320a55ec275445d7.tar.zst bun-b17df61043d154e06e290640320a55ec275445d7.zip | |
[bun dev] Upgrade-Insecure-Requests does not work for detecting HTTPS
Diffstat (limited to 'src')
| -rw-r--r-- | src/http.zig | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/src/http.zig b/src/http.zig index 75a65775d..e7cd94d53 100644 --- a/src/http.zig +++ b/src/http.zig @@ -128,11 +128,15 @@ pub const RequestContext = struct { if (protocol == null) { determine_protocol: { - // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Upgrade-Insecure-Requests - if (this.header("Upgrade-Insecure-Requests") != null) { - protocol = "https"; - break :determine_protocol; - } + // Upgrade-Insecure-Requests doesn't work + // Browsers send this header to clients that are not running HTTPS + // We need to use protocol-relative URLs in import statements and in websocket handler, we need to send the absolute URL it received + // That will be our fix + // // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Upgrade-Insecure-Requests + // if (this.header("Upgrade-Insecure-Requests") != null) { + // protocol = "https"; + // break :determine_protocol; + // } // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Proto if (this.header("X-Forwarded-Proto")) |proto| { |