From e05958e89ff0fdff7a7084e5ce356e02304e9621 Mon Sep 17 00:00:00 2001 From: javier Date: Mon, 6 Jul 2026 17:09:31 +0200 Subject: [PATCH] fix(proxy): confiar en X-Forwarded-Proto del proxy inverso (evita http:// tras https) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sin trustProxies, la app tras un proxy HTTPS (OpenResty/Nginx) genera URLs con http://, y las cookies "secure" no viajan → 419 en /livewire/update. Añadido $middleware->trustProxies(at: '*') con los headers X-Forwarded-*. Co-Authored-By: Claude Opus 4.7 --- bootstrap/app.php | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/bootstrap/app.php b/bootstrap/app.php index ff6354c..d9beb16 100644 --- a/bootstrap/app.php +++ b/bootstrap/app.php @@ -14,6 +14,17 @@ return Application::configure(basePath: dirname(__DIR__)) ->withMiddleware(function (Middleware $middleware): void { $middleware->appendToGroup('web', \App\Http\Middleware\SetLocale::class); + // Confiar en el proxy inverso (OpenResty/Nginx) para leer X-Forwarded-Proto: + // sin esto, tras HTTPS el proxy Laravel genera URLs con http:// y las cookies + // "secure" no viajan → 419 en /livewire/update. + $middleware->trustProxies(at: '*', headers: + Illuminate\Http\Request::HEADER_X_FORWARDED_FOR | + Illuminate\Http\Request::HEADER_X_FORWARDED_HOST | + Illuminate\Http\Request::HEADER_X_FORWARDED_PORT | + Illuminate\Http\Request::HEADER_X_FORWARDED_PROTO | + Illuminate\Http\Request::HEADER_X_FORWARDED_AWS_ELB, + ); + // Spatie permission + Sanctum ability middleware aliases $middleware->alias([ 'role' => \Spatie\Permission\Middleware\RoleMiddleware::class,