From 9bc1b73b5e7dd491930ff86c3c1e12679b41a21f Mon Sep 17 00:00:00 2001
From: James Brooks <james@alt-three.com>
Date: Tue, 11 Aug 2026 19:52:50 +0100
Subject: [PATCH 1/2] Configure trusted proxies

---
 src/CachetCoreServiceProvider.php    | 15 +++++++++++++
 tests/Feature/TrustedProxiesTest.php | 33 ++++++++++++++++++++++++++++
 2 files changed, 48 insertions(+)
 create mode 100644 tests/Feature/TrustedProxiesTest.php

diff --git a/src/CachetCoreServiceProvider.php b/src/CachetCoreServiceProvider.php
index e80dbe38..66c53c95 100644
--- a/src/CachetCoreServiceProvider.php
+++ b/src/CachetCoreServiceProvider.php
@@ -39,6 +39,7 @@
 use Illuminate\Database\Eloquent\Relations\Relation;
 use Illuminate\Foundation\Application;
 use Illuminate\Foundation\Console\AboutCommand;
+use Illuminate\Http\Middleware\TrustProxies;
 use Illuminate\Routing\Router;
 use Illuminate\Support\Facades\Blade;
 use Illuminate\Support\Facades\Event;
@@ -81,6 +82,18 @@ private function configureSettingsCache(): void
         }
     }
 
+    /**
+     * Configure Laravel to respect forwarded request headers from Cachet's trusted proxies.
+     */
+    private function configureTrustedProxies(): void
+    {
+        $trustedProxies = config('cachet.trusted_proxies');
+
+        if ($trustedProxies) {
+            TrustProxies::at($trustedProxies);
+        }
+    }
+
     /**
      * Bootstrap any application services.
      */
@@ -90,6 +103,8 @@ public function boot(): void
             $this->mergeConfigFrom(__DIR__.'/../config/cachet.php', 'cachet');
         }
 
+        $this->configureTrustedProxies();
+
         Route::middlewareGroup('cachet', config('cachet.middleware', []));
         Route::middlewareGroup('cachet:api', config('cachet.api_middleware', []));
         Route::middlewareGroup('cachet:mcp', config('cachet.mcp_middleware', []));
diff --git a/tests/Feature/TrustedProxiesTest.php b/tests/Feature/TrustedProxiesTest.php
new file mode 100644
index 00000000..f8f8c0fe
--- /dev/null
+++ b/tests/Feature/TrustedProxiesTest.php
@@ -0,0 +1,33 @@
+<?php
+
+namespace Cachet\Tests\Feature;
+
+use Cachet\Tests\TestCase;
+use Illuminate\Foundation\Application;
+use Illuminate\Http\Middleware\TrustProxies;
+use Illuminate\Http\Request;
+use Orchestra\Testbench\Attributes\DefineEnvironment;
+use Symfony\Component\HttpFoundation\Response;
+
+class TrustedProxiesTest extends TestCase
+{
+    protected function trustAllProxies(Application $app): void
+    {
+        $app['config']->set('cachet.trusted_proxies', '*');
+    }
+
+    #[DefineEnvironment('trustAllProxies')]
+    public function test_it_respects_the_forwarded_scheme_from_trusted_proxies(): void
+    {
+        $request = Request::create('/', server: [
+            'HTTP_X_FORWARDED_PROTO' => 'https',
+            'REMOTE_ADDR' => '127.0.0.1',
+        ]);
+
+        app(TrustProxies::class)->handle($request, function (Request $request): Response {
+            $this->assertTrue($request->isSecure());
+
+            return new Response;
+        });
+    }
+}

From 39a9f1e3941d52d774fa1ad10b68602503ab7822 Mon Sep 17 00:00:00 2001
From: James Brooks <james@alt-three.com>
Date: Thu, 13 Aug 2026 09:27:13 +0100
Subject: [PATCH 2/2] Reset trusted proxy test state

---
 tests/Feature/TrustedProxiesTest.php | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/tests/Feature/TrustedProxiesTest.php b/tests/Feature/TrustedProxiesTest.php
index f8f8c0fe..74d8f47f 100644
--- a/tests/Feature/TrustedProxiesTest.php
+++ b/tests/Feature/TrustedProxiesTest.php
@@ -11,6 +11,13 @@
 
 class TrustedProxiesTest extends TestCase
 {
+    protected function tearDown(): void
+    {
+        TrustProxies::flushState();
+
+        parent::tearDown();
+    }
+
     protected function trustAllProxies(Application $app): void
     {
         $app['config']->set('cachet.trusted_proxies', '*');