Skip to content

Go: Use X-Forwarded headers for users that are running services behind a proxy/reverse proxy.#1935

Open
woodybriggs wants to merge 2 commits intox402-foundation:mainfrom
woodybriggs:main
Open

Go: Use X-Forwarded headers for users that are running services behind a proxy/reverse proxy.#1935
woodybriggs wants to merge 2 commits intox402-foundation:mainfrom
woodybriggs:main

Conversation

@woodybriggs
Copy link
Copy Markdown

Description

when running servers in trusted environments such as kubernetes or if just sitting behind a reverse proxy like traefik or nginx the scheme of the resourceURL is incorrectly being set to http. This is due to the adapters looking specifically for a TLS connection state in the request object coming from the http lib/framework.

This PR aims to resolve this, by using standard proxy X-Forwarded Headers.

It should be said that the adapters assume that the X-Forwarded headers can be trusted. It may be wise to add to documentation that if the app is behind a proxy of some sort it will use X-Forwarded headers, and you should make sure that you are only allowing trusted proxies to hit your server.

Tests

tests added to ensure that https is handled correctly if no tls connection is present the x-forwarded headers can be used.

Checklist

  • I have formatted and linted my code

  • All new and existing tests pass

  • My commits are signed (required for merge) -- you may need to rebase if you initially pushed unsigned commits

  • I added a changelog fragment for user-facing changes (docs-only changes can skip)

  • Go: use X-Forwarded headers (if present) when constructing URL for payment-requried header.

@github-actions github-actions bot added go sdk Changes to core v2 packages labels Apr 4, 2026
@woodybriggs
Copy link
Copy Markdown
Author

#514

looks like this might be a problem in other language packages too

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

go sdk Changes to core v2 packages

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant