stacklok / toolhive / 28202472143

67%

Build Type

push

github

Committed by web-flow

Commit Message

fix(proxy): set X-Forwarded-Proto to upstream scheme for remote proxies (#5646)

* fix(proxy): set X-Forwarded-Proto to upstream scheme for remote proxies

When MCPRemoteProxy runs behind a TLS-terminating load balancer, the
inbound connection to the pod is plain HTTP even though the upstream is
reached over HTTPS. SetXForwarded derived X-Forwarded-Proto from that
inbound hop, so remote HTTPS upstreams that redirect when
X-Forwarded-Proto != https returned a 301 on every request and looped
until the redirect cap, leaving the upstream session uninitialized.

Rewrite X-Forwarded-Proto to the scheme of the actual upstream
connection (the targetURI scheme) for remote proxies, symmetric with the
existing X-Forwarded-Host removal.

Closes #5567

* refactor(proxy): reuse parsed upstream scheme and log X-Forwarded-Proto rewrite

Pass the upstream scheme (parsed once in Start) into setXForwardedHeaders
instead of re-parsing targetURI on every request, removing the dead
error branch. Add a slog.Debug when the X-Forwarded-Proto rewrite is
applied for remote upstreams.

---------

Co-authored-by: Claude <noreply@anthropic.com>

Coverage Stats

7 of 7 new or added lines in 1 file covered. (100.0%)

5 existing lines in 2 files now uncovered.

69526 of 103245 relevant lines covered (67.34%)

65.91 hits per line