From 240fd3c3f6673df475532e3afa024a37e3ccdf6f Mon Sep 17 00:00:00 2001 From: m105 Date: Tue, 21 Jul 2026 19:23:23 +0300 Subject: [PATCH] Trust reverse proxy headers to fix mixed-content on the subdomain MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit App is served behind a reverse proxy that terminates TLS and forwards plain HTTP to nginx on :8001. Without TrustProxies, Laravel couldn't see the original request was HTTPS, so Livewire generated an http:// update endpoint on an https:// page — browsers block that as mixed active content. Trusting proxy headers fixes URL generation while leaving direct LAN http:// access on :8001 unaffected. Co-Authored-By: Claude Sonnet 5 --- bootstrap/app.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/bootstrap/app.php b/bootstrap/app.php index 4b327d2..d04b44f 100644 --- a/bootstrap/app.php +++ b/bootstrap/app.php @@ -13,7 +13,11 @@ return Application::configure(basePath: dirname(__DIR__)) health: '/up', ) ->withMiddleware(function (Middleware $middleware): void { - // + // Behind a reverse proxy (nginx serves plain HTTP on :8001; TLS is + // terminated in front of it), so trust X-Forwarded-* headers — + // otherwise Laravel/Livewire generate http:// URLs even when the + // original request was https, tripping mixed-content blocking. + $middleware->trustProxies(at: '*'); }) ->withExceptions(function (Exceptions $exceptions): void { $exceptions->shouldRenderJsonWhen(