From ac87dea27303edb6b4ee6022cd1d1bd2bf6d7f5f Mon Sep 17 00:00:00 2001 From: jwinterm Date: Thu, 16 Jul 2026 08:50:07 -0400 Subject: [PATCH] fix: preserve public HTTPS checkout links --- nginx/conf.d/default.conf | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/nginx/conf.d/default.conf b/nginx/conf.d/default.conf index 16838af..86ac7fd 100644 --- a/nginx/conf.d/default.conf +++ b/nginx/conf.d/default.conf @@ -8,6 +8,14 @@ limit_req_zone $binary_remote_addr zone=global_rate_limit:10m rate=50r/s; # restarted. `valid=10s` bounds the stale window to ~10 seconds. resolver 127.0.0.11 valid=10s ipv6=off; +# Preserve a trusted outer proxy's HTTPS scheme without reflecting arbitrary +# client-supplied values into invoice and checkout URLs. +map $http_x_forwarded_proto $origin_scheme { + default $scheme; + http http; + https https; +} + server { listen 80; server_name xmrcheckout.such.software localhost; @@ -25,7 +33,7 @@ server { proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Proto $origin_scheme; } location /api { @@ -38,7 +46,7 @@ server { proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Proto $origin_scheme; } location /qr/ { @@ -53,6 +61,6 @@ server { proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Proto $origin_scheme; } }