bosia 0.7.5 → 0.7.6

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "bosia",
-	"version": "0.7.5",
+	"version": "0.7.6",
 	"type": "module",
 	"description": "A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun · ElysiaJS. File-based routing inspired by SvelteKit. No Node.js, no Vite, no adapters.",
 	"keywords": [

package/src/core/dev.ts

@@ -346,9 +346,17 @@ const devServer = Bun.serve({
 		target.hostname = "127.0.0.1";
 		target.port = String(APP_PORT);
 
+		// Preserve an X-Forwarded-* set by an OUTER proxy (e.g. a multi-tenant host
+		// fronting `bun run dev` behind TLS). Overwriting it with this dev proxy's
+		// own loopback host/scheme would strip the real public origin, so the app's
+		// redirects and `event.url` would point at localhost. Fall back to this
+		// proxy's request only when the outer hop didn't set them.
 		const forwardedHeaders = new Headers(req.headers);
-		forwardedHeaders.set("x-forwarded-host", reqUrl.host);
-		forwardedHeaders.set("x-forwarded-proto", reqUrl.protocol.replace(":", ""));
+		forwardedHeaders.set("x-forwarded-host", req.headers.get("x-forwarded-host") ?? reqUrl.host);
+		forwardedHeaders.set(
+			"x-forwarded-proto",
+			req.headers.get("x-forwarded-proto") ?? reqUrl.protocol.replace(":", ""),
+		);
 		// Force inner app to respond uncompressed. Bun's `fetch()` auto-decodes
 		// gzip/br bodies but leaves the original `Content-Encoding` header on
 		// the Response, so passing it through made Safari throw -1015 ("cannot

package/src/core/server.ts

@@ -781,6 +781,20 @@ if (_xfoDisabled) {
 }
 
 async function handleRequest(request: Request, url: URL): Promise<Response> {
+	// Behind a trusted proxy the inbound `Host`/scheme is the proxy's inner hop
+	// (e.g. `localhost:PORT` over plain HTTP), so `url` built from `request.url`
+	// misreports the public origin. Rebuild it from `X-Forwarded-Host`/`-Proto`
+	// so `event.url` — and every absolute redirect, canonical URL, and
+	// `url.origin` the app derives — points at the public-facing origin instead
+	// of localhost. Gated on TRUST_PROXY since these headers are client-spoofable
+	// when no proxy strips them.
+	if (TRUST_PROXY) {
+		const fwdHost = request.headers.get("x-forwarded-host");
+		if (fwdHost) url.host = fwdHost;
+		const fwdProto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim();
+		if (fwdProto) url.protocol = `${fwdProto}:`;
+	}
+
 	// Reject new non-health requests during shutdown
 	if (shuttingDown && url.pathname !== "/_health") {
 		return new Response("Service Unavailable", {