From 778da4df8ad43db6acb1c19c6a55d2de8c6d8aa9 Mon Sep 17 00:00:00 2001
From: "Sebastian BURGIN-FIX (ext)"
 <sebastian.burginfix_ext+sonepar@sonepar.com>
Date: Thu, 22 Oct 2026 21:58:56 +0200
Subject: [PATCH] fix: feedback links opened in a browser answered 403 behind
 the proxy

BlockBrowserNavigation runs before the trusted proxies are applied, so it
checked the signature against http:// while the link is https://. It now
only lets navigations to /v1/feedback/* with a signature through; the
route's signed middleware checks the signature on the correct URL.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                                  |  1 +
 .../Middleware/BlockBrowserNavigation.php     |  7 +++++--
 tests/Feature/FeedbackLinkTest.php            | 19 +++++++++++++++++++
 3 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9ac2819..38be452 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,7 @@ All notable changes to the API and the widget are documented here. The format fo
 
 ### Fixed
 
+- Feedback links answered 403 in browsers behind a TLS terminating proxy (Laravel Cloud): the navigation guard checked the signature against the http:// URL before the trusted proxies were applied. The route's signature check stays authoritative.
 - `<noscript>` content (e.g. of an Alpine toast region) showed up as literal markup in screenshots; `<noscript>` and `<template>` are now left out.
 - Screenshots with the script tag from the API: the lazy screenshot chunk was served without `Access-Control-Allow-Origin`, so other websites could not load it.
 - Screenshots of pages using Alpine, Vue or other framework attributes (`:class`, `x-on:click`) were blank.
diff --git a/app/Http/Middleware/BlockBrowserNavigation.php b/app/Http/Middleware/BlockBrowserNavigation.php
index 390df5f..410ce33 100644
--- a/app/Http/Middleware/BlockBrowserNavigation.php
+++ b/app/Http/Middleware/BlockBrowserNavigation.php
@@ -12,7 +12,10 @@
 /**
  * The API is only for the widget (CORS requests) and for monitoring. Typing
  * a URL into a browser is a navigation and gets an empty 403. The only
- * exception are valid signed links from feedback:link.
+ * exception are signed feedback links (feedback:link, share link): their
+ * signature is checked by the route's "signed" middleware, which runs after
+ * the trusted proxies are applied. Here, before that, the URL would still be
+ * http:// behind a TLS terminating proxy and no signature would match.
  */
 final class BlockBrowserNavigation
 {
@@ -21,7 +24,7 @@ public function handle(Request $request, Closure $next): Response
     {
         $navigation = $request->headers->get('Sec-Fetch-Mode') === 'navigate' || $request->headers->get('Sec-Fetch-Dest') === 'document';
 
-        if ($navigation && ! $request->hasValidSignature()) {
+        if ($navigation && ! ($request->is('v1/feedback/*') && $request->query->has('signature'))) {
             return new IlluminateResponse('', 403);
         }
 
diff --git a/tests/Feature/FeedbackLinkTest.php b/tests/Feature/FeedbackLinkTest.php
index 5e20154..4020b49 100644
--- a/tests/Feature/FeedbackLinkTest.php
+++ b/tests/Feature/FeedbackLinkTest.php
@@ -6,6 +6,7 @@
 use App\Models\FeedbackProject;
 use App\Models\FeedbackScreenshot;
 use App\Support\FeedbackLink;
+use Illuminate\Http\Middleware\TrustProxies;
 use Illuminate\Support\Facades\Artisan;
 use Illuminate\Support\Facades\URL;
 use Illuminate\Support\Str;
@@ -276,3 +277,21 @@ function entryWithShot(FeedbackProject $project, array $attributes = []): Feedba
     test()->post($action, ['status' => 'completed'])->assertForbidden();
     expect($entry->refresh()->completed_at)->toBeNull();
 });
+
+it('opens links behind a TLS terminating proxy (production)', function (): void {
+    // Laravel Cloud: the link is https, the app sees http plus X-Forwarded-Proto.
+    TrustProxies::at('*');
+    URL::forceScheme('https');
+    $this->beforeApplicationDestroyed(function (): void {
+        TrustProxies::flushState();
+        URL::forceScheme(null);
+    });
+    $entry = FeedbackEntry::factory()->for($this->project, 'project')->create();
+    $url = feedbackLink($entry->id)['url'];
+    expect($url)->toStartWith('https://');
+    $behindProxy = ['X-Forwarded-Proto' => 'https', 'X-Forwarded-Port' => '443', ...NAVIGATE];
+
+    test()->get(str_replace('https://', 'http://', $url), $behindProxy)->assertOk()->assertSee($entry->message);
+    test()->get(str_replace('https://', 'http://', str_replace('signature=', 'signature=0', $url)), $behindProxy)->assertForbidden()->assertContent('');
+    test()->get(str_replace('https://', 'http://', url('/up')).'?signature=x', $behindProxy)->assertForbidden()->assertContent('');
+});