From 7f2c1ec2827782f7bf8b8c5f75653fa8bf52be73 Mon Sep 17 00:00:00 2001
From: Liosha84 <Liosha84@gmail.com>
Date: Sat, 17 Oct 2026 22:29:31 +0200
Subject: [PATCH] fix: trust proxy forwarded headers so login works behind
 Caddy

Behind Jambotron's Caddy the app saw http while the browser used https,
so same-domain requests looked cross-origin and @CrossOrigin answered
403 on /api/auth/signin. server.forward-headers-strategy=framework makes
the app use X-Forwarded-Proto/Host; app.origin can be set via APP_ORIGIN.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 spring-angular-ui/nginx.conf        | 8 +++++++-
 src/main/resources/application.yaml | 8 +++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/spring-angular-ui/nginx.conf b/spring-angular-ui/nginx.conf
index 4097643..c91bbd0 100644
--- a/spring-angular-ui/nginx.conf
+++ b/spring-angular-ui/nginx.conf
@@ -1,3 +1,9 @@
+# Схема исходного запроса: за Caddy (https) — из его X-Forwarded-Proto, иначе своя
+map $http_x_forwarded_proto $forwarded_proto {
+    default $http_x_forwarded_proto;
+    ""      $scheme;
+}
+
 server {
     listen 80;
     server_name _;
@@ -12,7 +18,7 @@ server {
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Proto $forwarded_proto;
     }
 
     # Маршруты Angular (/admin, /tutorials/1 ...) отдаём через index.html
diff --git a/src/main/resources/application.yaml b/src/main/resources/application.yaml
index 41b0aba..f794037 100644
--- a/src/main/resources/application.yaml
+++ b/src/main/resources/application.yaml
@@ -24,4 +24,10 @@ app:
   # Совпадает со сроком жизни cookie (24 ч), иначе UI считает пользователя вошедшим, а API отвечает 401
   jwtExpirationMs: 86400000
   jwtCookieName: demo-decoupled
-  origin: http://localhost:4200
\ No newline at end of file
+  # Разрешённый origin для запросов с другого домена (dev-сервер Angular). UI через nginx фронта CORS не касается
+  origin: ${APP_ORIGIN:http://localhost:4200}
+
+# За обратным прокси (nginx фронта, Caddy Jambotron) приложение видит http. Без X-Forwarded-Proto/Host
+# запросы со своего https-домена выглядят кросс-доменными, и CORS отвечает на них 403
+server:
+  forward-headers-strategy: framework
\ No newline at end of file