Skip to content

Commit 16859bb

Browse files
authored
Use https in RDAP URLs provided (#2807)
Load balancer / internal redirections can result in the final request URL lacking "https" when finally getting to the servlet. As a result, even if you use https in the request, the resulting URL can be plain http. We need to include the actual (HTTPS) URL in the output, so replace it.
1 parent 7c92928 commit 16859bb

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

core/src/main/java/google/registry/request/RequestModule.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,8 @@ AuthResult provideAuthResult() {
135135
@Provides
136136
@RequestUrl
137137
static String provideRequestUrl(HttpServletRequest req) {
138-
return req.getRequestURL().toString();
138+
String url = req.getRequestURL().toString();
139+
return url.startsWith("https") ? url : url.replaceFirst("http", "https");
139140
}
140141

141142
@Provides

0 commit comments

Comments
 (0)