From 2be92926857111d3fbbb303326c105b26ccfb290 Mon Sep 17 00:00:00 2001 From: Liosha84 Date: Sat, 17 Oct 2026 22:29:41 +0200 Subject: [PATCH] fix: trust proxy forwarded headers so login works behind Caddy Behind Jambotron's Caddy the app saw http while the browser used https, so same-domain requests looked cross-origin and @CrossOrigin answered 403 on /api/auth/signin. server.forward-headers-strategy=framework makes the app use X-Forwarded-Proto/Host; app.origin can be set via APP_ORIGIN. Co-Authored-By: Claude Opus 5.5 --- src/main/resources/application.yaml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/main/resources/application.yaml b/src/main/resources/application.yaml index 5a9dcb0..36ea29e 100644 --- a/src/main/resources/application.yaml +++ b/src/main/resources/application.yaml @@ -24,4 +24,10 @@ app: # Совпадает со сроком жизни cookie (24 ч), иначе UI считает пользователя вошедшим, а API отвечает 401 jwtExpirationMs: 86400000 jwtCookieName: springangularts - origin: http://localhost:4200 \ No newline at end of file + # Разрешённый origin для запросов с другого домена (dev-сервер Angular). UI с того же домена CORS не касается + origin: ${APP_ORIGIN:http://localhost:4200} + +# За обратным прокси (Caddy Jambotron) приложение видит http. Без X-Forwarded-Proto/Host запросы со своего +# https-домена выглядят кросс-доменными, и @CrossOrigin отвечает на них 403 +server: + forward-headers-strategy: framework \ No newline at end of file