Redirect @latest switches from https to http

[de-peter]

hi, i'm using the docker image.

when using https://..../react@latest i'm getting a 302 with new location http://.../[email protected].... how can i change the behavior to stay on https://....?

[andi4000]

I'm also having this issue on kubernetes setup. It seems that the 302 redirect with http location is causing the real resource to fail loading with "CORS Missing Allow Origin". Maybe there's some Istio magic I could do, but it would really help if ESM.sh could return https location.

[andi4000]

Looking at the implementation here: https://github.com/esm-dev/esm.sh/blob/0c43d47346bb7fc944521bf79619297f97610441/server/router.go#L1789-L1803

Our "hack" is to add CF-Visitor: '{"scheme": "https"}' header to the request, before forwarding it to the ESM container, so that ESM returns https location.

Works with semver request like https://host/pkg@latest and https://host/pkg@^1.

[ije]

I'm thinking of adding an option for it.

[black-snow]

Yup, this is quite surprising and took some time to debug :)

[de-peter]

i've tried your hack. but imports to css didn't work. they answer with 302 found and a location target with http://...

i'm on azure and tried to add the header via application gateway. any ideas?

PS: Custom header CF-Visitor Header value {"scheme": "https"}

[ije]

you can simply add the X-Real-Origin header with "https://your-company.com" or use cloudflare

[de-peter]

that did the "trick". great. thanks

[nicky9door]

Ran into this issue today and resolved it with the CF-Visitor header. Wondering if it makes sense to check for the Forwarded and/or X-Forwarded-Proto headers as those seem to be fairly standard for reverse proxies / load balancers