fix(mcp): honour the proxy's forwarded scheme and host #15

Merged

TimCane merged 1 commit from fix/forwarded-headers into main

2026-07-19 17:12:54 +01:00

TimCane commented

2026-07-19 17:11:47 +01:00

(Migrated from github.com)

Summary

read X-Forwarded-Proto / X-Forwarded-Host so the app knows it is served over https on its public hostname, not plain http on an internal one
without this any absolute URL the app builds is wrong; OAuth metadata is the case that breaks outright, since clients reject a resource URI advertised as http://
clear the known-proxy allowlist: the proxy's address on the Docker network is not stable, and after #14 nothing but the proxy can reach the container
UseForwardedHeaders runs first so everything downstream sees the corrected values

Test plan

dotnet build clean; TreatWarningsAsErrors caught KnownNetworks as deprecated, now KnownIPNetworks
dotnet test green: 77 unit, 45 integration
not directly asserted - the integration suite has no WebApplicationFactory, and adding that tier for one middleware check was not worth it
verify against the deployed host once routing works: absolute URLs should come back https://

## Summary - read `X-Forwarded-Proto` / `X-Forwarded-Host` so the app knows it is served over https on its public hostname, not plain http on an internal one - without this any absolute URL the app builds is wrong; OAuth metadata is the case that breaks outright, since clients reject a resource URI advertised as `http://` - clear the known-proxy allowlist: the proxy's address on the Docker network is not stable, and after #14 nothing but the proxy can reach the container - `UseForwardedHeaders` runs first so everything downstream sees the corrected values ## Test plan - `dotnet build` clean; `TreatWarningsAsErrors` caught `KnownNetworks` as deprecated, now `KnownIPNetworks` - `dotnet test` green: 77 unit, 45 integration - [ ] not directly asserted - the integration suite has no `WebApplicationFactory`, and adding that tier for one middleware check was not worth it - [ ] verify against the deployed host once routing works: absolute URLs should come back `https://`