Repository navigation
fix: feedback links answered 403 in browsers - #39
Merged
Merged
Conversation
BlockBrowserNavigation runs before the trusted proxies are applied, so it checked the signature against http:// while the link is https://. It now only lets navigations to /v1/feedback/* with a signature through; the route's signed middleware checks the signature on the correct URL. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Signed feedback links (thank you screen,
feedback:link) answered an empty 403 when opened in a browser on feedback.codebar.ch, while the same URL without browser headers returned 200.Cause:
BlockBrowserNavigationis prepended and runs before the trusted proxies are applied. Behind Laravel Cloud's TLS terminating proxy it sawhttp://…, sohasValidSignature()failed for thehttps://link.Fix: the guard only lets navigations to
/v1/feedback/*carrying asignaturethrough; the route'ssignedmiddleware (after the proxies) checks the signature on the correct URL. Invalid or expired links still get the empty 403, every other navigation is still blocked.Tests: new Pest test with
TrustProxiesandX-Forwarded-Proto: httpsreproduces the production 403 without the fix and passes with it; 336 passed, Larastan/Pint clean, full stack E2E green.🤖 Generated with Claude Code