Trust reverse proxies so HTTPS asset URLs work behind CPM.

Without TrustProxies, Laravel generated http:// links after TLS termination and browsers blocked CSS/JS as mixed content.
2026-08-12 22:06:22 +02:00
parent 8a66cf6f63
commit d60851bb53
1 changed files with 10 additions and 0 deletions
@@ -13,6 +13,16 @@ return Application::configure(basePath: dirname(__DIR__))
        health: '/up',
    )
    ->withMiddleware(function (Middleware $middleware): void {
+        // CPM/Caddy terminates TLS; trust forwarded proto/host so asset() URLs stay https.
+        $middleware->trustProxies(
+            at: '*',
+            headers: Request::HEADER_X_FORWARDED_FOR
+                | Request::HEADER_X_FORWARDED_HOST
+                | Request::HEADER_X_FORWARDED_PORT
+                | Request::HEADER_X_FORWARDED_PROTO
+                | Request::HEADER_X_FORWARDED_PREFIX,
+        );
+
        $middleware->redirectGuestsTo(fn () => route('login'));
        $middleware->redirectUsersTo(fn () => route('recordings.index'));
    })