Improve HTTPS detection

Author: itssimon

common/utils.go

@@ -19,12 +19,45 @@ func TruncateValidationErrorMessage(msg string) string {
 
 func GetFullURL(req *http.Request) string {
 	scheme := "http"
-	if req.TLS != nil || req.Header.Get("X-Forwarded-Proto") == "https" {
+	if req.TLS != nil || isHTTPS(req.Header) {
 		scheme = "https"
 	}
 	return fmt.Sprintf("%s://%s%s", scheme, req.Host, req.URL.String())
 }
 
+func isHTTPS(header http.Header) bool {
+	for _, key := range []string{
+		"X-Forwarded-Proto",
+		"X-Forwarded-Protocol",
+		"X-Forwarded-Scheme",
+		"X-Url-Scheme",
+		"X-Scheme",
+	} {
+		if v := header.Get(key); v != "" {
+			scheme, _, _ := strings.Cut(v, ",")
+			if strings.TrimSpace(strings.ToLower(scheme)) == "https" {
+				return true
+			}
+		}
+	}
+	if v := header.Get("Forwarded"); v != "" {
+		for _, element := range strings.Split(v, ",") {
+			for _, param := range strings.Split(element, ";") {
+				param = strings.TrimSpace(param)
+				if k, val, ok := strings.Cut(param, "="); ok && strings.ToLower(strings.TrimSpace(k)) == "proto" {
+					if strings.ToLower(strings.Trim(strings.TrimSpace(val), "\"")) == "https" {
+						return true
+					}
+				}
+			}
+		}
+	}
+	if strings.EqualFold(header.Get("Front-End-Https"), "on") || strings.EqualFold(header.Get("X-Forwarded-Ssl"), "on") {
+		return true
+	}
+	return false
+}
+
 func ParseContentLength(contentLength string) int64 {
 	if contentLength != "" {
 		if size, err := strconv.ParseInt(contentLength, 10, 64); err == nil {

common/utils_test.go

@@ -18,6 +18,27 @@ func TestUtils(t *testing.T) {
 		assert.Equal(t, "https://example.com/test?q=1", GetFullURL(req))
 	})
 
+	t.Run("isHTTPS", func(t *testing.T) {
+		check := func(header, value string) bool {
+			h := http.Header{}
+			h.Set(header, value)
+			return isHTTPS(h)
+		}
+		assert.True(t, check("X-Forwarded-Proto", "https"))
+		assert.True(t, check("X-Forwarded-Proto", "https, http"))
+		assert.False(t, check("X-Forwarded-Proto", "http"))
+		assert.True(t, check("X-Forwarded-Protocol", "https"))
+		assert.True(t, check("X-Forwarded-Scheme", "https"))
+		assert.True(t, check("X-Url-Scheme", "https"))
+		assert.True(t, check("X-Scheme", "https"))
+		assert.True(t, check("Forwarded", "for=192.0.2.1;proto=https;host=example.com"))
+		assert.True(t, check("Forwarded", "proto=\"https\""))
+		assert.False(t, check("Forwarded", "for=192.0.2.1;proto=http"))
+		assert.True(t, check("Front-End-Https", "on"))
+		assert.True(t, check("X-Forwarded-Ssl", "on"))
+		assert.False(t, isHTTPS(http.Header{}))
+	})
+
 	t.Run("ParseContentLength", func(t *testing.T) {
 		assert.Equal(t, int64(-1), ParseContentLength(""))
 		assert.Equal(t, int64(-1), ParseContentLength("invalid"))