yamine 0.14.2 → 0.14.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 56dbba9d974dc247a9f96271e6dd40e0e68b170a6ad20f9e0660aa6fa1d20a28
-  data.tar.gz: 218da1110324af22c665581eeb26101a29628f1f4e96fed47e492aebd6c18488
+  metadata.gz: 8af42a840ce756689e6c37140a3a8cdf402c51aa71b9819b88df624d6a6ffaae
+  data.tar.gz: 0a51ab3de0e5605ea8b5152720f76957530722a1b65740dfebc0ab29d14337f9
 SHA512:
-  metadata.gz: 9e26fe517122747c2793eb2b441fe83289898796d47c99330d2589413873fa7a12ae1cc2a8b1da69928b39bc6f8ed01aa6e7647f682a872c80886d04d1a862be
-  data.tar.gz: ce6b77f5a0263594e698cae37ddd3673a8dc6e16a63b946f8bd0f3b939747d80ce86bbc19e100da84a4a7b38aa942de39d86cdc509e348d71d817bc7a6def433
+  metadata.gz: e7823296acbadf8e6cc07079ff3f2d3ad56809d2de4973e6ed821124888cd2ee2144e267a754e585454fbc5c808c23fb9984e8da9880de4fda3b2b58bfcfff65
+  data.tar.gz: 2642187bbffd601efb5272f557577014704a4415b76c45eefbfa177d3e337b62074d5b60f36525c7a25b174684af7ccc5da31bbd8abaf59a9cdfa9fb864fae96

data/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [0.14.3] — 2026-09-15
+
+### Fixed
+
+- **WebSocket upgrades carry the same forwarded headers as every other
+  request.** Upgrade requests (ActionCable, Turbo Streams over cable)
+  were piped to the backend byte-for-byte, so `X-Forwarded-Proto`,
+  `X-Forwarded-For`, and `X-Forwarded-Host` never arrived — the one
+  request class that skipped `set_forwarded`. An app behind the proxy
+  then saw a `wss://` connection as plain `http`, and Rails' ActionCable
+  origin check (Origin vs. scheme + Host) compared
+  `https://app.localhost` against `http://app.localhost` and refused the
+  socket with "Request origin not allowed". Upgrades now run the same
+  `set_forwarded` path as every other request before the head is
+  forwarded; the bytes after the header block still pipe raw.
+
 ## [0.14.2] — 2026-09-15
 
 ### Added

data/lib/yamine/proxy.rb

@@ -320,12 +320,18 @@ module Yamine
 
     def handle_upgrade(sock, head, buf)
       routes = cached_routes
-      _method, _target, headers = parse_head(head)
+      method, target, headers = parse_head(head)
       entry = route(headers["host"].to_s, routes)
       return unless entry
 
+      # Upgrades carry the same forwarded headers as every other request:
+      # an app behind the proxy (ActionCable's origin check) reads the
+      # scheme from X-Forwarded-Proto, and a verbatim head would tell a
+      # wss:// connection it arrived as http.
+      set_forwarded(headers, sock, tls: @tls)
+
       backend = dial(entry)
-      backend.write(head)
+      backend.write(rebuild_head(method, target, headers))
       backend.write(buf) unless buf.empty?
       pipe_both(sock, backend)
     rescue SystemCallError, OpenSSL::SSL::SSLError, IOError => e

data/lib/yamine/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Yamine
-  VERSION = "0.14.2"
+  VERSION = "0.14.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: yamine
 version: !ruby/object:Gem::Version
-  version: 0.14.2
+  version: 0.14.3
 platform: ruby
 authors:
 - Kaka Ruto