From 924e1cb02aa941c8e6e7abd7b76d19dd78eeb71d Mon Sep 17 00:00:00 2001 From: davidmonterocrespo24 Date: Sat, 9 May 2026 04:56:35 +0200 Subject: [PATCH] fix(nginx): use relative redirects so trailing-slash 301s preserve HTTPS MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Browsers were reporting: Unsafe attempt to load URL http://velxio.dev/examples/ from frame with URL https://velxio.dev/examples. Repro: curl -I https://velxio.dev/examples → 301 Location: http://velxio.dev/examples/ ← protocol downgraded Why: docker/nginx.conf has the container listening on `:80` only — TLS is terminated by the host nginx in front of it (which then proxies to http://127.0.0.1:3080). When nginx generates a trailing-slash 301 it uses the listening protocol (http) for the absolute Location header, not the X-Forwarded-Proto. The browser correctly blocks the redirect. Fix: `absolute_redirect off;` makes nginx emit relative Location headers (`Location: /examples/`), so the browser resolves them against the original request URL and HTTPS is preserved end-to-end. After fix: curl -I https://velxio.dev/examples → 301 Location: /examples/ Goes in the same branch as the BMP280 ninja-timeout fix because both are deploy-blocking and small. Co-Authored-By: Claude Opus 4.7 (1M context) --- docker/nginx.conf | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/docker/nginx.conf b/docker/nginx.conf index 33ca0d00..1989323b 100644 --- a/docker/nginx.conf +++ b/docker/nginx.conf @@ -5,6 +5,14 @@ server { root /usr/share/nginx/html; index index.html; + # Use relative redirects (e.g. `/examples/` instead of + # `http://velxio.dev/examples/`) so trailing-slash and other internal + # redirects don't downgrade HTTPS clients to HTTP. We sit behind a TLS + # terminator (host nginx → Cloudflare); without this nginx generates + # absolute Location headers using the listening protocol (http) and the + # browser blocks the redirect as mixed-content. + absolute_redirect off; + # Security headers add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Content-Type-Options "nosniff" always;