SSR origin honors X-Forwarded-Proto/-Host behind a TLS-terminating proxy

#991 seeds the API client + connect-card MCP URL from the document
request origin (request.url). Behind a proxy that terminates TLS and
forwards plain HTTP upstream — tailscale serve for the dev-share
workflow, or an nginx/Caddy front — request.url is http:// while the
browser is on https://, so the HTTPS page got an http:// API base and
blocked it as mixed content. Derive the origin from X-Forwarded-Proto/
-Host when present (extracted to a pure, unit-tested request-origin
module). No-op on Cloudflare, where request.url already carries the
external https origin.

Author: RhysSullivan

apps/cloud/src/auth/request-origin.test.ts

@@ -0,0 +1,60 @@
+import { describe, expect, it } from "@effect/vitest";
+
+import { browserOriginFromRequest } from "./request-origin";
+
+const req = (url: string, headers: Record<string, string> = {}): Request =>
+  new Request(url, { headers });
+
+describe("browserOriginFromRequest", () => {
+  it("uses the request URL origin when no proxy headers are present (Cloudflare)", () => {
+    expect(browserOriginFromRequest(req("https://executor.sh/acme/policies"))).toBe(
+      "https://executor.sh",
+    );
+  });
+
+  it("honors X-Forwarded-Proto to recover https behind a TLS-terminating proxy", () => {
+    // tailscale serve / nginx: browser on https, upstream request is http.
+    expect(
+      browserOriginFromRequest(
+        req("http://mac-mini.tail5665af.ts.net:47130/acme/policies", {
+          "x-forwarded-proto": "https",
+        }),
+      ),
+    ).toBe("https://mac-mini.tail5665af.ts.net:47130");
+  });
+
+  it("honors X-Forwarded-Host when the proxy rewrites the host", () => {
+    expect(
+      browserOriginFromRequest(
+        req("http://127.0.0.1:8080/", {
+          "x-forwarded-proto": "https",
+          "x-forwarded-host": "executor.sh",
+        }),
+      ),
+    ).toBe("https://executor.sh");
+  });
+
+  it("takes the first value of a comma-listed forwarded chain", () => {
+    expect(
+      browserOriginFromRequest(
+        req("http://internal:8080/", {
+          "x-forwarded-proto": "https, http",
+          "x-forwarded-host": "executor.sh, internal",
+        }),
+      ),
+    ).toBe("https://executor.sh");
+  });
+
+  it("falls back to the request scheme/host for the half-set header", () => {
+    // Only proto forwarded: keep the request's own host.
+    expect(
+      browserOriginFromRequest(req("http://localhost:43130/", { "x-forwarded-proto": "https" })),
+    ).toBe("https://localhost:43130");
+    // Only host forwarded: keep the request's own scheme.
+    expect(
+      browserOriginFromRequest(
+        req("http://localhost:43130/", { "x-forwarded-host": "executor.sh" }),
+      ),
+    ).toBe("http://executor.sh");
+  });
+});

apps/cloud/src/auth/request-origin.ts

@@ -0,0 +1,23 @@
+// The origin the BROWSER sees for a document request — what origin-derived UI
+// (the connect card's MCP URL, the API client's base) must be built from.
+//
+// On Cloudflare `request.url` already carries the external `https://` origin,
+// so this is a no-op there. Behind a TLS-terminating reverse proxy that
+// forwards plain HTTP upstream — `tailscale serve` for the dev-share workflow,
+// or an nginx/Caddy front — `request.url` is `http://` while the browser is on
+// `https://`; honoring the proxy's `X-Forwarded-Proto`/`-Host` recovers the
+// real origin (otherwise the HTTPS page would seed an `http://` API base and
+// the browser blocks it as mixed content).
+//
+// Trusting these headers is safe: the result only shapes the origin rendered
+// back to that same requester, never a cross-tenant decision (org access is
+// enforced server-side regardless of the URL the client was handed).
+//
+// Pure (no `cloudflare:workers`) so it unit-tests without the worker runtime.
+export const browserOriginFromRequest = (request: Request): string => {
+  const url = new URL(request.url);
+  const proto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim();
+  const host = request.headers.get("x-forwarded-host")?.split(",")[0]?.trim();
+  if (!proto && !host) return url.origin;
+  return `${proto || url.protocol.replace(":", "")}://${host || url.host}`;
+};

apps/cloud/src/auth/ssr-gate.ts

@@ -36,6 +36,7 @@ import { makeDbLayer } from "../db/db";
 import { makeUserStoreLayer, UserStoreService } from "./context";
 import { parseCookie } from "./cookies";
 import { sealedSessionDisplayName } from "./middleware";
+import { browserOriginFromRequest } from "./request-origin";
 import { loginPath, safeReturnTo } from "./return-to";
 import { ONBOARDING_PATHS, PUBLIC_PATHS } from "./route-paths";
 import { WorkOSClient } from "./workos";
@@ -239,7 +240,9 @@ export const authGateMiddleware = createMiddleware({ type: "request" }).server(
     // `http://127.0.0.1:4000` default — which would otherwise flash until
     // hydration corrected it. Set-cookie writes ride on the rendered response.
     const { hint, mint } = await resolveAuthHint(session, cookieHeader);
-    const result = await next({ context: { authHint: hint, origin: url.origin } });
+    const result = await next({
+      context: { authHint: hint, origin: browserOriginFromRequest(request) },
+    });
     if (!mint && !session.refreshedSession) return result;
 
     const response = new Response(result.response.body, result.response);