From 4db0f9fff0e922d16d4c44988439aa9a6b634037 Mon Sep 17 00:00:00 2001
From: Bryan Brooks <bryanbrooks@I3-MINI--BITS-2.local>
Date: Tue, 24 Feb 2026 13:01:46 -0600
Subject: [PATCH] fix: profile redirect uses x-forwarded-proto behind proxy

req.protocol returns 'http' behind reverse proxy, causing the
login redirect URL to fail the allowed origins check (403).
---
 gateway/src/routes/user-profile.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/gateway/src/routes/user-profile.ts b/gateway/src/routes/user-profile.ts
index 6b97b48..cbb9583 100644
--- a/gateway/src/routes/user-profile.ts
+++ b/gateway/src/routes/user-profile.ts
@@ -84,7 +84,8 @@ export function createUserProfileRoutes(
   router.get('/', (req: Request, res: Response) => {
     const session = getSession(req);
     if (!session) {
-      const profileUrl = `${req.protocol}://${req.get('host')}/auth/profile`;
+      const proto = req.get('x-forwarded-proto') || req.protocol;
+      const profileUrl = `${proto}://${req.get('host')}/auth/profile`;
       return res.redirect(`/auth/proxy/login?rd=${encodeURIComponent(profileUrl)}`);
     }
 
-- 
knotmirror 0.0.1