[Bug-1134] Sign-in redirect loses public origin behind tunnel

Story 1134Epic None2 files · +126/−14

PR #282 · pramaan-io/pramaan-app · merged 2026-06-10

Why this matters

Sign-in bounces back to localhost.

The browser came in on the public host. The server sent it back to localhost.

The proxy knew. The server didn't.

The fix — Trust the forwarded host, not the request URL.

How it flows

sequenceDiagram
  autonumber
  participant browser as Browser
  participant tunnel as Tunnel / Proxy
  participant nextjs as Next.js proxy.ts
  browser->>tunnel: GET app.com/sign-in
  tunnel->>nextjs: GET /sign-in + x-forwarded-host
  nextjs->>nextjs: getPublicRequestOrigin() reads the label
  nextjs->>browser: Location: https://app.com/auth

Files changed (2)

File	±
`src/proxy.ts` ★	+39 −6
`tests/unit/proxy.test.ts`	+87 −8