From e3f7cd9d00e25562ddfe6d14718895397a5ef606 Mon Sep 17 00:00:00 2001 From: Shekhar Kumar Date: Mon, 20 Apr 2026 04:27:58 +0530 Subject: [PATCH] fix(landing): use public origin for download redirects behind proxies (#498) Prefer x-forwarded host/proto for redirect URL construction so users are not sent to internal localhost origins. Fixes #496 --- landing/src/app/download/[platform]/route.ts | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/landing/src/app/download/[platform]/route.ts b/landing/src/app/download/[platform]/route.ts index b3b0b9b8..05b5077f 100644 --- a/landing/src/app/download/[platform]/route.ts +++ b/landing/src/app/download/[platform]/route.ts @@ -15,17 +15,32 @@ const PLATFORM_ALIAS: Record = { windows: 'windows', }; +function getPublicOrigin(request: NextRequest): string { + const forwardedHost = request.headers.get('x-forwarded-host'); + const forwardedProto = request.headers.get('x-forwarded-proto'); + + if (forwardedHost && forwardedProto) { + // Behind reverse proxies/CDNs, request.url can be an internal origin + // (for example localhost:8080). Prefer forwarded headers so redirects + // keep users on the public domain. + return `${forwardedProto}://${forwardedHost}`; + } + + return new URL(request.url).origin; +} + export async function GET( request: NextRequest, { params }: { params: Promise<{ platform: string }> }, ) { + const origin = getPublicOrigin(request); const { platform } = await params; // No prebuilt Linux binary yet — send straight to the build-from-source page. if (platform === 'linux') { - return NextResponse.redirect(new URL('/linux-install', request.url), 307); + return NextResponse.redirect(new URL('/linux-install', origin), 307); } const normalized = PLATFORM_ALIAS[platform]; - const target = new URL('/download', request.url); + const target = new URL('/download', origin); if (normalized) target.searchParams.set('platform', normalized); return NextResponse.redirect(target, 307); }