Adira c2fe0a6475 fix(http): honor X-Forwarded-Prefix when proxy strips the prefix (#9614) ... * fix(http): honor X-Forwarded-Prefix when proxy strips the prefix Closes #9145. Two related issues kept the React UI from loading when a reverse proxy rewrites a sub-path with prefix-stripping (e.g. Caddy `handle_path`): 1. `BaseURL` only computed a prefix from the path StripPathPrefix had removed, so when the proxy strips the prefix before forwarding, the request arrives without it and the base URL was returned without a prefix. Extract a `BasePathPrefix` helper and add an `X-Forwarded-Prefix` header fallback so the prefix is recovered. 2. `<base href>` only changes how relative URLs resolve; the build emits path-absolute references like `/assets/...` and `/favicon.svg`, which still resolve against the origin and bypass the proxy prefix. Rewrite those references in the served `index.html` so the browser requests them through the proxy. Adds unit coverage for `BaseURL` with a pre-stripped path and an end-to-end test for the proxy-stripped scenario. Assisted-by: Claude:claude-opus-4-7 * fix(http): gate X-Forwarded-Prefix through SafeForwardedPrefix in BasePathPrefix BasePathPrefix consumed X-Forwarded-Prefix directly, so a value the codebase elsewhere rejects (e.g. "//evil.com") slipped through and was interpolated into the SPA index.html — both into the path-absolute asset URL rewrite in serveIndex (turning "/assets/..." into "//evil.com/assets/...", a protocol-relative URL that loads JS from a foreign origin) and into <base href>. Route the header through the existing SafeForwardedPrefix validator that StripPathPrefix and prefixRedirect already use, and HTML-escape the prefix before injecting it into the asset rewrite as defense in depth against attribute breakout. Tests cover //evil.com, backslashes, control chars, CR/LF and a missing leading slash; the integration test asserts an unsafe prefix can't poison asset URLs. Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Assisted-by: claude-code:claude-opus-4-7-1m [Read] [Edit] [Bash] --------- Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Co-authored-by: Ettore Di Giacinto <mudler@localai.io>		2026-05-13 21:59:33 +02:00
..
auth	chore: Security hardening (#9719)	2026-05-08 16:25:45 +02:00
endpoints	feat(realtime): Add Liquid Audio s2s model and assistant mode on talk page (#9801)	2026-05-13 21:57:27 +02:00
middleware	fix(http): honor X-Forwarded-Prefix when proxy strips the prefix (#9614)	2026-05-13 21:59:33 +02:00
react-ui	feat(realtime): Add Liquid Audio s2s model and assistant mode on talk page (#9801)	2026-05-13 21:57:27 +02:00
routes	feat(realtime): Add Liquid Audio s2s model and assistant mode on talk page (#9801)	2026-05-13 21:57:27 +02:00
static	feat(realtime): WebRTC support (#8790)	2026-03-13 21:37:15 +01:00
views	feat(realtime): WebRTC support (#8790)	2026-03-13 21:37:15 +01:00
app.go	fix(http): honor X-Forwarded-Prefix when proxy strips the prefix (#9614)	2026-05-13 21:59:33 +02:00
app_test.go	fix(http): honor X-Forwarded-Prefix when proxy strips the prefix (#9614)	2026-05-13 21:59:33 +02:00
csrf_multipart_test.go	chore: Security hardening (#9719)	2026-05-08 16:25:45 +02:00
explorer.go	chore(refactor): move logging to common package based on slog (#7668)	2025-12-21 19:33:13 +01:00
http_suite_test.go	refactor(tests): split app_test.go, move real-backend coverage to e2e-backends	2026-04-27 23:09:20 +00:00
openresponses_test.go	feat: add distributed mode (#9124)	2026-03-30 00:47:27 +02:00
render.go	feat: add distributed mode (#9124)	2026-03-30 00:47:27 +02:00
route_coverage_test.go	chore: Security hardening (#9719)	2026-05-08 16:25:45 +02:00