Issue Description
Context.Scheme() is documented as returning http or https, but X-Forwarded-Proto, X-Forwarded-Protocol, and X-Url-Scheme values are returned as-is.
This affects middleware.WWWRedirect() and middleware.NonWWWRedirect(), since both use c.Scheme() when building the Location header.
Example:
Host: app.example
X-Forwarded-Proto: //external.example
With middleware.WWWRedirect(), the response contains:
Location: //external.example://www.app.example/
Because the value starts with //, browsers resolve the Location as a network-path reference with host external.example.
This requires the redirect middleware to be enabled and the forwarded header to reach Echo. Context.Scheme() should ignore forwarded scheme values other than http and https, matching its documented return values.
Relevant code
In context.go:
if scheme := c.request.Header.Get(HeaderXForwardedProto); scheme != "" {
return scheme
}
if scheme := c.request.Header.Get(HeaderXForwardedProtocol); scheme != "" {
return scheme
}
if scheme := c.request.Header.Get(HeaderXUrlScheme); scheme != "" {
return scheme
}In middleware/redirect.go:
return true, scheme + "://www." + host + uri
return true, scheme + "://" + host[4:] + uri
Version/commit
This appears to affect both the current v5 branch and the supported v4 branch.
Issue Description
Context.Scheme()is documented as returninghttporhttps, butX-Forwarded-Proto,X-Forwarded-Protocol, andX-Url-Schemevalues are returned as-is.This affects
middleware.WWWRedirect()andmiddleware.NonWWWRedirect(), since both usec.Scheme()when building theLocationheader.Example:
With
middleware.WWWRedirect(), the response contains:Location: //external.example://www.app.example/Because the value starts with
//, browsers resolve theLocationas a network-path reference with hostexternal.example.This requires the redirect middleware to be enabled and the forwarded header to reach Echo.
Context.Scheme()should ignore forwarded scheme values other thanhttpandhttps, matching its documented return values.Relevant code
In
context.go:In
middleware/redirect.go:Version/commit
This appears to affect both the current v5 branch and the supported v4 branch.