docs: drop TrustProxies.php from reverse-proxy guidance - #114
Open
nicdavidson wants to merge 2 commits into
Open
docs: drop TrustProxies.php from reverse-proxy guidance#114nicdavidson wants to merge 2 commits into
nicdavidson wants to merge 2 commits into
Conversation
The product does not ship that middleware. Document FORCE_HTTPS and nginx scheme passthrough instead, and scope APP_URL to OAuth discovery. Fixes #112
FORCE_HTTPS is read with env() in AppServiceProvider, so a cached config dump makes the setting a no-op and redirects go back to http.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #112.
The reverse-proxy section on the MCP deployment page told operators to edit
app/Http/Middleware/TrustProxies.php. DreamFactory does not ship that file (app/Http/Middleware/only hasPreventRequestForgery.php), so a customer following the page goes looking for something that is not there.The same section also overstated
APP_URL. Discovery URLs read it directly, so setting it to the external HTTPS URL is enough for MCP OAuth. Laravel-generated redirects (including/→ the admin UI) are built from the incoming request, so behind a TLS-terminating proxy they still come back ashttp://.Changes
TrustProxies.phpblock from Deploying the MCP Server.APP_URLto OAuth discovery, and documentFORCE_HTTPS=trueas the supported application-level switch (URL::forceScheme('https')inAppServiceProvider).X-Forwarded-Proto→fastcgi_param HTTPSrecipe.FORCE_HTTPSto the.envparameter list on Basic Configuration.Verified
npm run buildwith no broken-link warnings.