PR #9645 breaks HTTPS links from Trusted Proxy middleware

[o1y]

Bug description

When configuring trusted proxies, all untrusted HTTP Site links will be cached caused by PR #9645. This causes issues where HTTPS Site links are required, e.g. for resolving the correct Site in a Multi-Site setup as described in #10079. I have opened a new issue because it may also cause other problems where HTTPS Site links are required by Statamic.

How to reproduce

1. Run Statamic behind a reverse proxy, e.g. use nginx with the following config:

location / {
 proxy_pass http://statamic:80; # replace with statamic service
 proxy_set_header Host $host;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-Proto $scheme;
}

2. In Statamic enable Trusted Proxies middleware, e.g. using $middleware->trustProxies(at: '*');
3. Use a multi site setup with the following sites config:

default:
 name: English
 locale: en
 url: /en
de:
 name: Deutsch
 locale: de
 url: /de

4. Access frontend through reverse proxy. All urls 404.

When reverting #9645, this resolves this issue.

The mentioned issue #10079 describes a workaround for the problem and suggests using absolute urls in the site config, but I think it would be better to fix the root cause.

Logs

No response

Environment

Environment
Application Name: Laravel
Laravel Version: 11.7.0
PHP Version: 8.3.6
Composer Version: 2.7.6
Environment: local
Debug Mode: ENABLED
URL: localhost:8082
Maintenance Mode: OFF

Cache
Config: NOT CACHED
Events: NOT CACHED
Routes: NOT CACHED
Views: NOT CACHED

Drivers
Broadcasting: log
Cache: statamic
Database: sqlite
Logs: stack / single
Mail: log
Queue: database
Session: file

Statamic
Addons: 0
Sites: 2 (English, Deutsch)
Stache Watcher: Enabled
Static Caching: Disabled
Version: 5.2.0 PRO

Installation

Fresh statamic/statamic site via CLI

Additional details

No response

[jasonvarga]

Brilliant thanks

[ali-awwad]

I do have the same problem. Now even when setting the absolute url in the sites yaml file. Still our AWS Load Balancer will send traffic to EC2 instance through HTTP and not HTTPS.

This was working fine for 4, but for Statamic 5 it is not.

The issue is in Sites.php , findByUrl method. Forcing https makes it work.

 public function findByUrl($url)
 {
 $url = Str::before($url, '?');
 $url = Str::ensureRight($url, '/');

 /*change*/
 $url = preg_replace('/^http:/', 'https:', $url);
 /*end change*/

 return $this->sites
 ->filter(fn ($site) => Str::startsWith($url, Str::ensureRight($site->absoluteUrl(), '/')))
 ->sortByDesc
 ->url()
 ->first();
 }

Notes: I have the trusted proxies set to "*", and the URL::forceScheme('https'); already setup in the AppServiceProvider.php

[o1y]

@ali-awwad You could also temporarily composer patch statamic/cms using this patch file.