Configure trusted proxies

src/CachetCoreServiceProvider.php

@@ -39,6 +39,7 @@
 use Illuminate\Database\Eloquent\Relations\Relation;
 use Illuminate\Foundation\Application;
 use Illuminate\Foundation\Console\AboutCommand;
+use Illuminate\Http\Middleware\TrustProxies;
 use Illuminate\Routing\Router;
 use Illuminate\Support\Facades\Blade;
 use Illuminate\Support\Facades\Event;
@@ -81,6 +82,18 @@ private function configureSettingsCache(): void
         }
     }
 
+    /**
+     * Configure Laravel to respect forwarded request headers from Cachet's trusted proxies.
+     */
+    private function configureTrustedProxies(): void
+    {
+        $trustedProxies = config('cachet.trusted_proxies');
+
+        if ($trustedProxies) {
+            TrustProxies::at($trustedProxies);
+        }
+    }
+
     /**
      * Bootstrap any application services.
      */
@@ -90,6 +103,8 @@ public function boot(): void
             $this->mergeConfigFrom(__DIR__.'/../config/cachet.php', 'cachet');
         }
 
+        $this->configureTrustedProxies();
+
         Route::middlewareGroup('cachet', config('cachet.middleware', []));
         Route::middlewareGroup('cachet:api', config('cachet.api_middleware', []));
         Route::middlewareGroup('cachet:mcp', config('cachet.mcp_middleware', []));

tests/Feature/TrustedProxiesTest.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace Cachet\Tests\Feature;
+
+use Cachet\Tests\TestCase;
+use Illuminate\Foundation\Application;
+use Illuminate\Http\Middleware\TrustProxies;
+use Illuminate\Http\Request;
+use Orchestra\Testbench\Attributes\DefineEnvironment;
+use Symfony\Component\HttpFoundation\Response;
+
+class TrustedProxiesTest extends TestCase
+{
+    protected function tearDown(): void
+    {
+        TrustProxies::flushState();
+
+        parent::tearDown();
+    }
+
+    protected function trustAllProxies(Application $app): void
+    {
+        $app['config']->set('cachet.trusted_proxies', '*');
+    }
+
+    #[DefineEnvironment('trustAllProxies')]
+    public function test_it_respects_the_forwarded_scheme_from_trusted_proxies(): void
+    {
+        $request = Request::create('/', server: [
+            'HTTP_X_FORWARDED_PROTO' => 'https',
+            'REMOTE_ADDR' => '127.0.0.1',
+        ]);
+
+        app(TrustProxies::class)->handle($request, function (Request $request): Response {
+            $this->assertTrue($request->isSecure());
+
+            return new Response;
+        });
+    }
+}