<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Mar 15, 2017, at 1:20 AM, Ilya Skriblovsky <<a href="mailto:ilyaskriblovsky@gmail.com" class="">ilyaskriblovsky@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">Ok, so in the sort term you are suggesting to change Request.URLPath</div></div></blockquote><div><br class=""></div><div>Yes.</div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""> (uppercased method? Hmm)</div></div></blockquote><div><br class=""></div><div>Like I said, not a great interface, overall :-).</div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""> to use Host header instead of getRequestHostname and to change Klein to use it instead of Request.getHost(), right?<div class="">Sounds wise and reasonable :)</div></div></div></blockquote><div><br class=""></div><div>OK, glad you agree :).</div><br class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div class="">But I'd like to add one more thing. In order to build correct external URL we need to know is it http or https. Currently URLPath is using Request.isSecure(), but it is not sufficient since Request.isSecure() just checks if backend connection is SSL while encryption is often terminated at a reverse proxy. Can we add "useXForwardedProto=False" argument to Request.URLPath() and check X-Forwarded-Proto header if it is true? And may be add "useXForwardedHost=False" too to simplify setting up a reverse proxy (with a bold red warning in docstring that it can be set to True only if reverse proxy is correctly configured to drop corresponding client-specified headers). What do you think?</div></div></blockquote><br class=""></div><div>I think that for starters, it would make more sense to just fix it to <i class="">always</i> honor forwarded-for and x-forwarded-for headers. The code calling request.URLPath(), in a given Resource, or application, is highly unlikely to know whether it wants to honor (x-)forwarded-for. The code that might know about this sort of configuration would be the thing that constructs the Site object, but I'd be much happier to just get a change that always honors it first, and then figure out how to customize it later.</div><div><br class=""></div><div>-glyph</div><div><br class=""></div></body></html>