From 395b19243223218e1443938ac3bccffb109a1576 Mon Sep 17 00:00:00 2001 From: hudson Date: Wed, 16 Sep 2026 15:15:06 -0400 Subject: [PATCH] Set trust proxy so NIP-98 URL matching works behind traefik (X-Forwarded-Proto) --- src/server.ts | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/server.ts b/src/server.ts index 9e7aea1..c7acb43 100644 --- a/src/server.ts +++ b/src/server.ts @@ -83,6 +83,13 @@ const verifyNip98Auth = async (req: Request): Promise => { export const server: express.Application = express() +// Behind a TLS-terminating reverse proxy (traefik in the ansible deploy). +// Without this, req.protocol stays "http" and verifyNip98Auth builds an +// expectedUrl of http://…, which no browser client will ever sign (clients +// sign https://…). Trust one proxy hop so req.protocol honors +// X-Forwarded-Proto and NIP-98 URL matching works. +server.set('trust proxy', 1) + // CORS middleware for browser-facing routes only. // The browser hits /subscription with an Authorization header and Content-Type: // application/json, which triggers a CORS preflight. Answer it and allow the