Read X-Forwarded-Proto header if trustProxy flag set

lib/response/headers.js

@@ -46,7 +46,13 @@ exports.location = function (uri, server, request) {
         return uri;
     }
 
-    var baseUri = server.settings.location || (server.info.protocol + '://' + ((request && request.info.host) || (server.info.host + ':' + server.info.port)));
+    var baseUri;
+    if (server.settings.trustProxy) {
+        baseUri = server.settings.location || ((request && request.headers ? request.headers['x-forwarded-proto'] || server.info.protocol : server.info.protocol) + '://' + ((request && request.info.host) || (server.info.host + ':' + server.info.port)));
+    }
+    else {
+        baseUri = server.settings.location || (server.info.protocol + '://' + ((request && request.info.host) || (server.info.host + ':' + server.info.port)));
+    }
     return baseUri + (uri.charAt(0) === '/' ? '' : '/') + uri;
 };
 

lib/schema.js

@@ -145,7 +145,8 @@ internals.server = Joi.object({
     views: internals.viewBase.keys({
         engines: Joi.object().required()
     }),
-    maxSockets: Joi.number().positive().allow(false)
+    maxSockets: Joi.number().positive().allow(false),
+    trustProxy: Joi.boolean()
 });
 
 

test/response.js

@@ -3538,6 +3538,49 @@ describe('Response', function () {
                 done();
             });
         });
+
+        it('returns a 302 redirection reply using X-Forwarded-Proto header protocol when trustProxy true', function (done) {
+
+            var handler = function (request, reply) {
+
+                return reply().redirect('example').temporary().rewritable();
+            };
+
+            var server = new Hapi.Server({trustProxy: true});
+            server.route({ method: 'GET', path: '/', config: { handler: handler } });
+
+            var options = {
+                url: '/',
+                headers: {}
+            };
+
+            options.headers['X-Forwarded-Proto'] = 'https';
+
+            server.inject(options, function (res) {
+
+                expect(res.statusCode).to.equal(302);
+                expect(res.headers.location).to.equal('https://0.0.0.0:80/example');
+                done();
+            });
+        });
+
+        it('returns a 302 redirection reply normally when trustProxy true', function (done) {
+
+            var handler = function (request, reply) {
+
+                return reply().redirect('example').temporary().rewritable();
+            };
+
+            var server = new Hapi.Server({trustProxy: true});
+            server.route({ method: 'GET', path: '/', config: { handler: handler } });
+
+            server.inject('/', function (res) {
+
+                expect(res.statusCode).to.equal(302);
+                expect(res.headers.location).to.equal('http://0.0.0.0:80/example');
+                done();
+            });
+        });
     });
 
     describe('Closed', function () {

test/server.js

@@ -1582,18 +1582,39 @@ describe('Server', function () {
             done();
         });
 
+        it('returns back the an absolute location using server config when trustProxy is true', function (done) {
+
+            var server = new Hapi.Server({ location: 'http://example.net', trustProxy: true });
+            expect(server.location('/test')).to.equal('http://example.net/test');
+            done();
+        });
+
         it('returns back the an absolute location using request host', function (done) {
 
             var server = new Hapi.Server();
             expect(server.location('/test', { info: { host: 'example.edu' } })).to.equal('http://example.edu/test');
             done();
         });
 
+        it('returns back the an absolute location using request host when trustProxy is true', function (done) {
+
+            var server = new Hapi.Server({trustProxy: true});
+            expect(server.location('/test', { info: { host: 'example.edu' } })).to.equal('http://example.edu/test');
+            done();
+        });
+
         it('returns back the an absolute location using server info', function (done) {
 
             var server = new Hapi.Server();
             expect(server.location('/test')).to.equal('http://0.0.0.0:80/test');
             done();
         });
+
+        it('returns back the an absolute location using server info when trustProxy is true', function (done) {
+
+            var server = new Hapi.Server({trustProxy: true});
+            expect(server.location('/test')).to.equal('http://0.0.0.0:80/test');
+            done();
+        });
     });
 });