@njinlabs/njin 0.10.2 → 0.10.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@njinlabs/njin",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "description": "A modern framework for building company profiles, landing pages, and content-driven websites.",
   "type": "module",
   "keywords": ["bun", "elysia", "surrealdb", "edgejs", "cms", "framework"],

package/src/modules/analytics.ts

@@ -46,6 +46,21 @@ export const resolveClientIp = (
   return server?.requestIP(request)?.address ?? null;
 };
 
+// `request.url` reflects what the backend itself sees — behind a reverse proxy that
+// terminates TLS (the common case), that's `http://` even though visitors hit the site
+// over `https://`. That scheme mismatch alone breaks isSameOrigin's exact comparison,
+// so every internal navigation gets misclassified as an external referrer. Prefer the
+// headers a trusted proxy sets; fall back to request.url for direct connections.
+export const resolveRequestOrigin = (request: Request) => {
+  const forwardedHost = request.headers.get("x-forwarded-host");
+  if (forwardedHost) {
+    const proto = request.headers.get("x-forwarded-proto")?.split(",")[0]!.trim() || "http";
+    return `${proto}://${forwardedHost.split(",")[0]!.trim()}`;
+  }
+
+  return new URL(request.url).origin;
+};
+
 const hashVisitor = (ip: string, userAgent: string) => {
   const today = moment().format("YYYY-MM-DD");
   return new Bun.CryptoHasher("sha256").update(`${ip}:${userAgent}:${today}`).digest("hex");

package/src/modules/view.ts

@@ -155,13 +155,13 @@ const view = makeModule(() => {
           });
 
           // Fire-and-forget — never awaited, so it can't add latency to the response.
-          import("./analytics").then(({ default: analytics, resolveClientIp }) =>
+          import("./analytics").then(({ default: analytics, resolveClientIp, resolveRequestOrigin }) =>
             analytics().track({
               path,
               referrer: request.headers.get("referer"),
               userAgent: request.headers.get("user-agent"),
               ip: resolveClientIp(request, server),
-              requestUrl: request.url,
+              requestUrl: resolveRequestOrigin(request),
             }),
           );