fix: respect X-Forwarded-Prefix in RequestURL - #4555

Open

wyh0626 wants to merge 1 commit into

ory:masterfrom

wyh0626:fix/requesturl-forwarded-prefix

GitHub Advanced Security / CodeQL succeeded Apr 4, 2026 in 2s

2 new alerts including 2 medium severity security vulnerabilities

New alerts in code changed by this pull request

Security Alerts:

2 medium

See annotations below for details.

View all branch alerts.

Annotations

Check warning on line 99 in x/http.go

Code scanning / CodeQL

Bad redirect check Medium

This is a check that

, which flows into a

, has a leading slash, but not that it does not have '/' or '' in its second position.
This is a check that

, which flows into a

, has a leading slash, but not that it does not have '/' or '' in its second position.
This is a check that

, which flows into a

, has a leading slash, but not that it does not have '/' or '' in its second position.
This is a check that

, which flows into a

, has a leading slash, but not that it does not have '/' or '' in its second position.
This is a check that

, which flows into a

, has a leading slash, but not that it does not have '/' or '' in its second position.
This is a check that

, which flows into a

, has a leading slash, but not that it does not have '/' or '' in its second position.
This is a check that

, which flows into a

, has a leading slash, but not that it does not have '/' or '' in its second position.
This is a check that

, which flows into a

, has a leading slash, but not that it does not have '/' or '' in its second position.
This is a check that

, which flows into a

, has a leading slash, but not that it does not have '/' or '' in its second position.

Check warning on line 101 in x/http.go

Code scanning / CodeQL

Bad redirect check Medium

This is a check that

, which flows into a

, has a leading slash, but not that it does not have '/' or '' in its second position.
This is a check that

, which flows into a

, has a leading slash, but not that it does not have '/' or '' in its second position.
This is a check that

, which flows into a

, has a leading slash, but not that it does not have '/' or '' in its second position.
This is a check that

, which flows into a

, has a leading slash, but not that it does not have '/' or '' in its second position.
This is a check that

, which flows into a

, has a leading slash, but not that it does not have '/' or '' in its second position.
This is a check that

, which flows into a

, has a leading slash, but not that it does not have '/' or '' in its second position.
This is a check that

, which flows into a

, has a leading slash, but not that it does not have '/' or '' in its second position.
This is a check that

, which flows into a

, has a leading slash, but not that it does not have '/' or '' in its second position.
This is a check that

, which flows into a

, has a leading slash, but not that it does not have '/' or '' in its second position.

Navigation Menu

Uh oh!

fix: respect X-Forwarded-Prefix in RequestURL - #4555