HTTPS only: nothing taken over plain http through a proxy 9a8e3b4419e0

    let https = app_https(&app);

        .layer(axum::middleware::from_fn_with_state(https, https_only))

/// The site's https address, when it has one: what [`https_only`] redirects to.

fn app_https(app: &Shared) -> Option<String> {

    let base = app.config.base_url();

    base.starts_with("https://").then(|| base.trim_end_matches('/').to_string())

}

/// The scheme a proxy in front of the hub says the visitor used

/// (`X-Forwarded-Proto`, else Cloudflare's `CF-Visitor`); `None` for a

/// request made to the hub directly (runners and tools on its host).

fn forwarded_scheme(headers: &axum::http::HeaderMap) -> Option<String> {

    if let Some(p) = headers.get("x-forwarded-proto").and_then(|v| v.to_str().ok()) {

        return p.split(',').next().map(|s| s.trim().to_ascii_lowercase());

    }

    let visitor = headers.get("cf-visitor").and_then(|v| v.to_str().ok())?;

    serde_json::from_str::<serde_json::Value>(visitor).ok()?["scheme"].as_str().map(str::to_ascii_lowercase)

}

/// HTTPS only (oxygenhub#218): on a site whose address is https, a request

/// a proxy reports as plain http is sent to the https address (GET and

/// HEAD) or refused (anything else, so a form or a password is never taken

/// over http). Requests made to the hub directly carry no such report and

/// are untouched.

async fn https_only(

    axum::extract::State(https): axum::extract::State<Option<String>>,

    req: axum::extract::Request,

    next: axum::middleware::Next,

) -> axum::response::Response {

    use axum::response::IntoResponse;

    let Some(base) = https else { return next.run(req).await };

    if forwarded_scheme(req.headers()).as_deref() != Some("http") {

        return next.run(req).await;

    }

    let to = format!("{base}{}", req.uri().path_and_query().map(|p| p.as_str()).unwrap_or("/"));

    if matches!(*req.method(), axum::http::Method::GET | axum::http::Method::HEAD) {

        return axum::response::Redirect::permanent(&to).into_response();

    }

    (axum::http::StatusCode::BAD_REQUEST, format!("This site takes requests over HTTPS only: send it to {to}\n")).into_response()

}

    let secure = if app.config.base_url().starts_with("https://") { "; Secure" } else { "" };

    let cookie = format!("{}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0{secure}", auth::SESSION_COOKIE);

    let secure = if app.config.base_url().starts_with("https://") { "; Secure" } else { "" };

            (header::SET_COOKIE, format!("theme={theme}; Path=/; Max-Age=31536000; SameSite=Lax{secure}")),

            (header::SET_COOKIE, format!("backdrop={backdrop}; Path=/; Max-Age=31536000; SameSite=Lax{secure}")),

/// #218: on an https site, what a proxy reports as plain http is sent to

/// https (pages) or refused (forms), so a password is never taken over

/// http; requests made to the hub directly are untouched; cookies are

/// Secure.

#[tokio::test(flavor = "multi_thread")]

async fn an_https_site_takes_nothing_over_http() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.server.base_url = "https://hub.example.org".into();

    config.registration.mode = "open".into();

    let app = oxygenhub::build(config).await.unwrap();

    let call = |method: &'static str, path: &'static str, header: Option<(&'static str, &'static str)>, body: Option<&'static str>| {

        let app = app.clone();

        async move {

            let mut req = Request::builder().method(method).uri(path);

            if let Some((k, v)) = header {

                req = req.header(k, v);

            }

            if body.is_some() {

                req = req.header(header::CONTENT_TYPE, "application/x-www-form-urlencoded");

            }

            oxygenhub::router(app).oneshot(req.body(body.map(Body::from).unwrap_or_else(Body::empty)).unwrap()).await.unwrap()

        }

    };

    // A page asked for over http (as the tunnel reports it) goes to https, path and query kept.

    let r = call("GET", "/login?next=%2Fx", Some(("x-forwarded-proto", "http")), None).await;

    assert!(r.status().is_redirection(), "{}", r.status());

    assert_eq!(r.headers().get(header::LOCATION).unwrap(), "https://hub.example.org/login?next=%2Fx");

    // A form over http is refused, whichever header says so.

    let r = call("POST", "/login", Some(("cf-visitor", r#"{"scheme":"http"}"#)), Some("username=a&password=b")).await;

    assert_eq!(r.status(), StatusCode::BAD_REQUEST);

    // Over https, and asked of the hub directly (its runners), it answers.

    assert_eq!(call("GET", "/login", Some(("x-forwarded-proto", "https")), None).await.status(), StatusCode::OK);

    assert_eq!(call("GET", "/login", None, None).await.status(), StatusCode::OK);

    // The session cookie is Secure.

    let r = call(

        "POST",

        "/register",

        Some(("x-forwarded-proto", "https")),

        Some("username=andy&email=a%40example.org&password=correct-horse-battery"),

    )

    .await;

    let cookie = r.headers().get(header::SET_COOKIE).expect("signed in").to_str().unwrap();

    assert!(cookie.contains("; Secure") && cookie.contains("HttpOnly"), "{cookie}");

}

## HTTPS only (oxygenhub#218)

When `base_url` is `https://…`, the hub takes nothing over plain http

through a proxy: a request that `X-Forwarded-Proto` (or Cloudflare's

`CF-Visitor`) reports as http is redirected to the same path on

`base_url` (GET and HEAD) or refused with 400 (anything else), and every

cookie it sets is `Secure`. Requests made to the hub directly, such as a

runner on the same host using `http://127.0.0.1:7300`, carry no such

header and are served as before. In front, Cloudflare's Always Use HTTPS

is on (2026-10-15). Strict-Transport-Security is not sent yet: it waits

for the security headers (#222) and the site owner's decision, because

browsers remember it for months.