Support path prefix in reverse proxy scenarios.

MIvanchev · MIvanchev · commit a2578fe8c635 · 2026-04-24T08:29:32.000+02:00
diff --git a/crates/wastebin_server/src/handlers/delete/form.rs b/crates/wastebin_server/src/handlers/delete/form.rs
@@ -15,7 +15,7 @@ pub async fn delete(
     async {
         let id = id.parse()?;
         db.delete_for(id, uid).await?;
-        Ok(Redirect::to("/"))
+        Ok(crate::redirect("/"))
     }
     .await
     .map_err(|err| make_error(err, page.clone(), theme))
diff --git a/crates/wastebin_server/src/handlers/extract.rs b/crates/wastebin_server/src/handlers/extract.rs
@@ -143,7 +143,7 @@ where
             .and_then(|referer| referer.to_str().ok())
             .map(|referer| {
                 if referer.starts_with('/') && !referer.starts_with("//") {
-                    Redirect::to(referer)
+                    crate::redirect(referer)
                 } else {
                     referer
                         .parse::<url::Url>()
@@ -155,10 +155,10 @@ where
                                 |q| Redirect::to(&format!("{path}?{q}")),
                             )
                         })
-                        .unwrap_or_else(|| Redirect::to("/"))
+                        .unwrap_or_else(|| crate::redirect("/"))
                 }
             })
-            .unwrap_or_else(|| Redirect::to("/"));
+            .unwrap_or_else(|| crate::redirect("/"));
 
         Ok(SafeReferer(redirect))
     }
diff --git a/crates/wastebin_server/src/handlers/insert/form.rs b/crates/wastebin_server/src/handlers/insert/form.rs
@@ -83,7 +83,7 @@ pub async fn post<E: std::fmt::Debug>(
         let mut cookie = cookie("uid", uid.to_string());
         cookie.set_secure(true);
 
-        Ok((jar.add(cookie), Redirect::to(&url)))
+        Ok((jar.add(cookie), crate::redirect(&url)))
     }
     .await
     .map_err(|err| make_error(err, page, theme))
diff --git a/crates/wastebin_server/src/main.rs b/crates/wastebin_server/src/main.rs
@@ -14,7 +14,7 @@ use std::time::Duration;
 use axum::extract::{DefaultBodyLimit, FromRef, Request, State};
 use axum::http::{HeaderName, HeaderValue, StatusCode};
 use axum::middleware::{Next, from_fn, from_fn_with_state};
-use axum::response::{IntoResponse, Response};
+use axum::response::{IntoResponse, Redirect, Response};
 use axum::routing::{Router, get, post};
 use axum_extra::extract::cookie::Key;
 use futures::future::TryFutureExt;
@@ -23,6 +23,7 @@ use http::header::{
     X_XSS_PROTECTION,
 };
 use tokio::net::{TcpListener, UnixListener};
+use tokio::task_local;
 use tower::ServiceBuilder;
 use tower_http::compression::CompressionLayer;
 use tower_http::timeout::TimeoutLayer;
@@ -34,6 +35,10 @@ use crate::handlers::extract::Theme;
 use crate::handlers::{delete, download, html, insert, raw, robots, theme};
 use wastebin_core::db::Database;
 
+task_local! {
+    static PATH_PREFIX: String;
+}
+
 /// Reference counted [`page::Page`] wrapper.
 pub(crate) type Page = Arc<page::Page>;
 
@@ -79,6 +84,26 @@ impl FromRef<AppState> for Cache {
     }
 }
 
+fn path_prefix() -> String {
+    PATH_PREFIX.with(|val| val.to_string())
+}
+
+fn redirect(uri: &str) -> Redirect {
+    let prefixed_uri = path_prefix() + uri;
+    Redirect::to(&prefixed_uri)
+}
+
+async fn path_prefix_layer(req: Request, next: Next) -> Response {
+    let prefix = req
+        .headers()
+        .get("x-forwarded-prefix")
+        .and_then(|val| val.to_str().ok())
+        .unwrap_or("")
+        .to_string();
+
+    PATH_PREFIX.scope(prefix, next.run(req)).await
+}
+
 async fn security_headers_layer(req: Request, next: Next) -> impl IntoResponse {
     // Rendered Markdown may embed remote images via `![](…)`; relax img-src for that route only.
     const CSP_STRICT: HeaderValue = HeaderValue::from_static(
@@ -234,6 +259,7 @@ fn make_app(state: AppState, timeout: Duration, max_body_size: usize) -> Router
                     timeout,
                 ))
                 .layer(from_fn_with_state(state.clone(), handle_service_errors))
+                .layer(from_fn(path_prefix_layer))
                 .layer(from_fn(security_headers_layer)),
         )
         .with_state(state)
diff --git a/crates/wastebin_server/templates/base.html b/crates/wastebin_server/templates/base.html
@@ -1,3 +1,4 @@
+{% let path_prefix = crate::path_prefix() %}
 <!DOCTYPE html>
 <html lang="en">
   <head>
@@ -7,27 +8,27 @@
     <title>{{ page.title }}{% block title_content %}{% endblock %}</title>
     {% match theme %}
       {% when Some with (Theme::Dark) %}
-        <link rel="stylesheet" href="{{ page.assets.css.dark.route() }}">
+        <link rel="stylesheet" href="{{ path_prefix }}{{ page.assets.css.dark.route() }}">
       {% when Some with (Theme::Light) %}
-        <link rel="stylesheet" href="{{ page.assets.css.light.route() }}">
+        <link rel="stylesheet" href="{{ path_prefix }}{{ page.assets.css.light.route() }}">
       {% when Some with (Theme::System) %}
-        <link rel="stylesheet" href="{{ page.assets.css.dark.route() }}" media="(prefers-color-scheme: dark)">
-        <link rel="stylesheet" href="{{ page.assets.css.light.route() }}" media="(prefers-color-scheme: light)">
+        <link rel="stylesheet" href="{{ path_prefix }}{{ page.assets.css.dark.route() }}" media="(prefers-color-scheme: dark)">
+        <link rel="stylesheet" href="{{ path_prefix }}{{ page.assets.css.light.route() }}" media="(prefers-color-scheme: light)">
       {% when None %}
-        <link rel="stylesheet" href="{{ page.assets.css.dark.route() }}" media="(prefers-color-scheme: dark)">
-        <link rel="stylesheet" href="{{ page.assets.css.light.route() }}" media="(prefers-color-scheme: light)">
+        <link rel="stylesheet" href="{{ path_prefix }}{{ page.assets.css.dark.route() }}" media="(prefers-color-scheme: dark)">
+        <link rel="stylesheet" href="{{ path_prefix }}{{ page.assets.css.light.route() }}" media="(prefers-color-scheme: light)">
     {% endmatch %}
-    <link rel="stylesheet" href="{{ page.assets.css.style.route() }}">
-    <link rel="icon" href="{{ page.assets.favicon.route() }}" type="image/png">
-    <noscript><link rel="stylesheet" href="{{ page.assets.css.no_js.route() }}"></noscript>
+    <link rel="stylesheet" href="{{ path_prefix }}{{ page.assets.css.style.route() }}">
+    <link rel="icon" href="{{ path_prefix }}{{ page.assets.favicon.route() }}" type="image/png">
+    <noscript><link rel="stylesheet" href="{{ path_prefix }}{{ page.assets.css.no_js.route() }}"></noscript>
     {% block head %}{% endblock %}
   </head>
   <body>
     {% block body %}
     <div id="main-container">
       <header>
         <div class="nav-group">
-          <a href="/" class="nav-button" title="home" aria-label="home">
+          <a href="{{ path_prefix }}/" class="nav-button" title="home" aria-label="home">
             <svg viewBox="0 0 24 24" width="16" height="16" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="m3 9 9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><path d="M9 22V12h6v10"/></svg>
           </a>
           {% block title %}{% endblock %}
@@ -37,43 +38,43 @@
           <div class="theme-switcher">
             {% match theme %}
               {% when None %}
-                <a href="/theme?pref=dark" class="theme-opt" title="dark mode">
+                <a href="{{ path_prefix }}/theme?pref=dark" class="theme-opt" title="dark mode">
                   <svg viewBox="0 0 24 24" width="12" height="12" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 3a6 6 0 0 0 9 9 9 9 0 1 1-9-9Z"/></svg>
                 </a>
-                <a href="/theme?pref=light" class="theme-opt" title="light mode">
+                <a href="{{ path_prefix }}/theme?pref=light" class="theme-opt" title="light mode">
                   <svg viewBox="0 0 24 24" width="12" height="12" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="4"/><path d="M12 2v2"/><path d="M12 20v2"/><path d="m4.93 4.93 1.41 1.41"/><path d="m17.66 17.66 1.41 1.41"/><path d="M2 12h2"/><path d="M20 12h2"/><path d="m6.34 17.66-1.41 1.41"/><path d="m19.07 4.93-1.41 1.41"/></svg>
                 </a>
-                <a href="/theme?pref=system" class="theme-opt active" title="auto mode">
+                <a href="{{ path_prefix }}/theme?pref=system" class="theme-opt active" title="auto mode">
                   <svg viewBox="0 0 24 24" width="12" height="12" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect width="20" height="14" x="2" y="3" rx="2"/><path d="M8 21h8"/><path d="M12 17v4"/></svg>
                 </a>
               {% when Some with (Theme::System) %}
-                <a href="/theme?pref=dark" class="theme-opt" title="dark mode">
+                <a href="{{ path_prefix }}/theme?pref=dark" class="theme-opt" title="dark mode">
                   <svg viewBox="0 0 24 24" width="12" height="12" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 3a6 6 0 0 0 9 9 9 9 0 1 1-9-9Z"/></svg>
                 </a>
-                <a href="/theme?pref=light" class="theme-opt" title="light mode">
+                <a href="{{ path_prefix }}/theme?pref=light" class="theme-opt" title="light mode">
                   <svg viewBox="0 0 24 24" width="12" height="12" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="4"/><path d="M12 2v2"/><path d="M12 20v2"/><path d="m4.93 4.93 1.41 1.41"/><path d="m17.66 17.66 1.41 1.41"/><path d="M2 12h2"/><path d="M20 12h2"/><path d="m6.34 17.66-1.41 1.41"/><path d="m19.07 4.93-1.41 1.41"/></svg>
                 </a>
-                <a href="/theme?pref=system" class="theme-opt active" title="auto mode">
+                <a href="{{ path_prefix }}/theme?pref=system" class="theme-opt active" title="auto mode">
                   <svg viewBox="0 0 24 24" width="12" height="12" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect width="20" height="14" x="2" y="3" rx="2"/><path d="M8 21h8"/><path d="M12 17v4"/></svg>
                 </a>
               {% when Some with (Theme::Dark) %}
-                <a href="/theme?pref=dark" class="theme-opt active" title="dark mode">
+                <a href="{{ path_prefix }}/theme?pref=dark" class="theme-opt active" title="dark mode">
                   <svg viewBox="0 0 24 24" width="12" height="12" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 3a6 6 0 0 0 9 9 9 9 0 1 1-9-9Z"/></svg>
                 </a>
-                <a href="/theme?pref=light" class="theme-opt" title="light mode">
+                <a href="{{ path_prefix }}/theme?pref=light" class="theme-opt" title="light mode">
                   <svg viewBox="0 0 24 24" width="12" height="12" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="4"/><path d="M12 2v2"/><path d="M12 20v2"/><path d="m4.93 4.93 1.41 1.41"/><path d="m17.66 17.66 1.41 1.41"/><path d="M2 12h2"/><path d="M20 12h2"/><path d="m6.34 17.66-1.41 1.41"/><path d="m19.07 4.93-1.41 1.41"/></svg>
                 </a>
-                <a href="/theme?pref=system" class="theme-opt" title="auto mode">
+                <a href="{{ path_prefix }}/theme?pref=system" class="theme-opt" title="auto mode">
                   <svg viewBox="0 0 24 24" width="12" height="12" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect width="20" height="14" x="2" y="3" rx="2"/><path d="M8 21h8"/><path d="M12 17v4"/></svg>
                 </a>
               {% when Some with (Theme::Light) %}
-                <a href="/theme?pref=dark" class="theme-opt" title="dark mode">
+                <a href="{{ path_prefix }}/theme?pref=dark" class="theme-opt" title="dark mode">
                   <svg viewBox="0 0 24 24" width="12" height="12" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 3a6 6 0 0 0 9 9 9 9 0 1 1-9-9Z"/></svg>
                 </a>
-                <a href="/theme?pref=light" class="theme-opt active" title="light mode">
+                <a href="{{ path_prefix }}/theme?pref=light" class="theme-opt active" title="light mode">
                   <svg viewBox="0 0 24 24" width="12" height="12" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="4"/><path d="M12 2v2"/><path d="M12 20v2"/><path d="m4.93 4.93 1.41 1.41"/><path d="m17.66 17.66 1.41 1.41"/><path d="M2 12h2"/><path d="M20 12h2"/><path d="m6.34 17.66-1.41 1.41"/><path d="m19.07 4.93-1.41 1.41"/></svg>
                 </a>
-                <a href="/theme?pref=system" class="theme-opt" title="auto mode">
+                <a href="{{ path_prefix }}/theme?pref=system" class="theme-opt" title="auto mode">
                   <svg viewBox="0 0 24 24" width="12" height="12" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect width="20" height="14" x="2" y="3" rx="2"/><path d="M8 21h8"/><path d="M12 17v4"/></svg>
                 </a>
             {% endmatch %}
diff --git a/crates/wastebin_server/templates/burn.html b/crates/wastebin_server/templates/burn.html
@@ -3,7 +3,7 @@
 <div class="flex-center">
   <div class="centered-label">burn after reading</div>
   <div class="centered-body">
-    Copy and send <a class="text-link" href="/{{ key }}">this link</a>.<br>
+    Copy and send <a class="text-link" href="{{ path_prefix }}/{{ key }}">this link</a>.<br>
     After opening it for the first time, it will be deleted.
   </div>
   <div class="qr-container">
diff --git a/crates/wastebin_server/templates/encrypted.html b/crates/wastebin_server/templates/encrypted.html
@@ -7,7 +7,7 @@
 {% block content %}
   <div class="flex-center">
     <div class="centered-label">encrypted paste</div>
-    <form action="/{{ id }}" method="post">
+    <form action="{{ path_prefix }}/{{ id }}" method="post">
       <div class="controls">
         <div class="password-input-wrap">
           <input type="password" id="password" name="password" placeholder="password …" autofocus>
diff --git a/crates/wastebin_server/templates/error.html b/crates/wastebin_server/templates/error.html
@@ -3,6 +3,6 @@
   <div class="flex-center">
     <div class="error-emoji">😢</div>
     <div class="centered-body">{{ description }}</div>
-    <a class="text-link" href="/">go back</a>
+    <a class="text-link" href="{{ path_prefix  }}/">go back</a>
   </div>
 {% endblock %}
diff --git a/crates/wastebin_server/templates/formatted.html b/crates/wastebin_server/templates/formatted.html
@@ -55,6 +55,6 @@
   </div>
   {{ html|safe }}
   {% if !is_available %}
-  <script defer src="{{ page.assets.burn_js.route()}}"></script>
+  <script defer src="{{ path_prefix }}{{ page.assets.burn_js.route()}}"></script>
   {% endif %}
 {% endblock %}
diff --git a/crates/wastebin_server/templates/index.html b/crates/wastebin_server/templates/index.html
diff --git a/crates/wastebin_server/templates/paste.html b/crates/wastebin_server/templates/paste.html
diff --git a/crates/wastebin_server/templates/qr.html b/crates/wastebin_server/templates/qr.html

Original file line number	Diff line number	Diff line change
`@@ -15,7 +15,7 @@ pub async fn delete(`
`15`	`15`	`async {`
`16`	`16`	`let id = id.parse()?;`
`17`	`17`	`db.delete_for(id, uid).await?;`
`18`		`- Ok(Redirect::to("/"))`
	`18`	`+ Ok(crate::redirect("/"))`
`19`	`19`	`}`
`20`	`20`	`.await`
`21`	`21`	`.map_err(\|err\| make_error(err, page.clone(), theme))`
Original file line number	Diff line number	Diff line change
`@@ -83,7 +83,7 @@ pub async fn post<E: std::fmt::Debug>(`
`83`	`83`	`let mut cookie = cookie("uid", uid.to_string());`
`84`	`84`	`cookie.set_secure(true);`
`85`	`85`
`86`		`- Ok((jar.add(cookie), Redirect::to(&url)))`
	`86`	`+ Ok((jar.add(cookie), crate::redirect(&url)))`
`87`	`87`	`}`
`88`	`88`	`.await`
`89`	`89`	`.map_err(\|err\| make_error(err, page, theme))`