Skip to content

Fix Location header to respect X-Forwarded-Proto and X-Forwarded-Host headers #3095

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Copilot wants to merge 3 commits into
base: main
Choose a base branch
from
+14 −8
Open

Fix Location header to respect X-Forwarded-Proto and X-Forwarded-Host headers #3095

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b9eea70
Initial plan
Copilot Feb 2, 2026
8f36397
Fix Location header to respect X-Forwarded-Proto and X-Forwarded-Host…
Copilot Feb 2, 2026
57c170a
Merge branch 'main' into copilot/fix-location-header-scheme
anushakolan Mar 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions src/Core/Resolvers/SqlMutationEngine.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -397,9 +397,12 @@ await queryExecutor.ExecuteQueryAsync(
case EntityActionOperation.Insert:

HttpContext httpContext = GetHttpContext();
// Use scheme/host from X-Forwarded-* headers if present, else fallback to request values
string scheme = SqlPaginationUtil.ResolveRequestScheme(httpContext.Request);
string host = SqlPaginationUtil.ResolveRequestHost(httpContext.Request);
string locationHeaderURL = UriHelper.BuildAbsolute(
scheme: httpContext.Request.Scheme,
host: httpContext.Request.Host,
scheme: scheme,
host: new HostString(host),
Comment on lines +400 to +405
Copy link

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add integration test coverage to verify POST to a stored procedure returns a Location header using X-Forwarded-Proto and X-Forwarded-Host when present (similar to existing pagination nextLink forwarded-header test). This change alters externally visible response headers and is currently untested.

Copilot uses AI. Check for mistakes.
pathBase: GetBaseRouteFromConfig(_runtimeConfigProvider.GetConfig()),
path: httpContext.Request.Path);

Expand Down
8 changes: 4 additions & 4 deletions src/Core/Resolvers/SqlPaginationUtil.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -756,7 +756,7 @@ public static string FormatQueryString(NameValueCollection? queryStringParameter
/// <param name="req">The HTTP request.</param>
/// <returns>The scheme string ("http" or "https").</returns>
/// <exception cref="DataApiBuilderException">Thrown when client explicitly sets an invalid scheme.</exception>
private static string ResolveRequestScheme(HttpRequest req)
internal static string ResolveRequestScheme(HttpRequest req)
{
string? rawScheme = req.Headers["X-Forwarded-Proto"].FirstOrDefault();
string? normalized = rawScheme?.Trim().ToLowerInvariant();
Expand All @@ -780,7 +780,7 @@ private static string ResolveRequestScheme(HttpRequest req)
/// <param name="req">The HTTP request.</param>
/// <returns>The host string.</returns>
/// <exception cref="DataApiBuilderException">Thrown when client explicitly sets an invalid host.</exception>
private static string ResolveRequestHost(HttpRequest req)
internal static string ResolveRequestHost(HttpRequest req)
{
string? rawHost = req.Headers["X-Forwarded-Host"].FirstOrDefault();
string? trimmed = rawHost?.Trim();
Expand All @@ -803,7 +803,7 @@ private static string ResolveRequestHost(HttpRequest req)
/// </summary>
/// <param name="scheme">Scheme, e.g., "http" or "https".</param>
/// <returns>True if valid, otherwise false.</returns>
private static bool IsValidScheme(string? scheme)
internal static bool IsValidScheme(string? scheme)
{
return scheme is "http" or "https";
}
Expand All @@ -813,7 +813,7 @@ private static bool IsValidScheme(string? scheme)
/// </summary>
/// <param name="host">The host name (with optional port).</param>
/// <returns>True if valid, otherwise false.</returns>
private static bool IsValidHost(string? host)
internal static bool IsValidHost(string? host)
{
Comment on lines 803 to 817
Copy link

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IsValidScheme/IsValidHost were changed to internal but are not referenced outside SqlPaginationUtil. Keeping them private reduces internal API surface area unless there’s a concrete need for other types to call them.

Copilot uses AI. Check for mistakes.
if (string.IsNullOrWhiteSpace(host))
{
Expand Down
7 changes: 5 additions & 2 deletions src/Core/Resolvers/SqlResponseHelpers.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -381,9 +381,12 @@ HttpContext httpContext
// The third part is the computed primary key route.
if (operationType is EntityActionOperation.Insert && !string.IsNullOrEmpty(primaryKeyRoute))
{
// Use scheme/host from X-Forwarded-* headers if present, else fallback to request values
string scheme = SqlPaginationUtil.ResolveRequestScheme(httpContext.Request);
string host = SqlPaginationUtil.ResolveRequestHost(httpContext.Request);
locationHeaderURL = UriHelper.BuildAbsolute(
scheme: httpContext.Request.Scheme,
host: httpContext.Request.Host,
scheme: scheme,
host: new HostString(host),
pathBase: baseRoute,
Comment on lines +384 to 390
Copy link

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add integration test coverage to verify entity POST/insert returns a Location header using X-Forwarded-Proto and X-Forwarded-Host when present. Existing Location header tests assume localhost/http and won't catch regressions for reverse-proxy scenarios.

Copilot uses AI. Check for mistakes.
path: httpContext.Request.Path);

Expand Down
Loading