From 8849cceb767187664dd6973cb7d403eb67445311 Mon Sep 17 00:00:00 2001
From: Pulse Monitor <pulse@pulse-monitor.dev>
Date: Tue, 19 Aug 2025 16:27:16 +0000
Subject: [PATCH] fix: support WebSocket connections through reverse proxies

- Handle X-Forwarded-Proto and X-Forwarded-Host headers in origin check
- Fixes WebSocket connections failing when accessed via reverse proxy
- Addresses #333 where connections broke after v4.3
---
 internal/websocket/hub.go | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/internal/websocket/hub.go b/internal/websocket/hub.go
index 7be253efa..a4c509a22 100644
--- a/internal/websocket/hub.go
+++ b/internal/websocket/hub.go
@@ -31,12 +31,25 @@ func (h *Hub) checkOrigin(r *http.Request) bool {
 	allowedOrigins := h.allowedOrigins
 	h.mu.RUnlock()
 	
-	// Always allow same-origin requests
+	// Determine the actual origin based on proxy headers
 	scheme := "http"
-	if r.TLS != nil {
+	host := r.Host
+	
+	// Check if we're behind a reverse proxy
+	if forwardedProto := r.Header.Get("X-Forwarded-Proto"); forwardedProto != "" {
+		scheme = forwardedProto
+	} else if r.TLS != nil {
 		scheme = "https"
 	}
-	requestOrigin := scheme + "://" + r.Host
+	
+	// Use X-Forwarded-Host if available (for reverse proxy scenarios)
+	if forwardedHost := r.Header.Get("X-Forwarded-Host"); forwardedHost != "" {
+		host = forwardedHost
+	}
+	
+	requestOrigin := scheme + "://" + host
+	
+	// Allow same-origin requests (accounting for proxy headers)
 	if origin == requestOrigin {
 		return true
 	}