HTTP: have getServerHTTPS() honor https baseurlpath when $_SERVER['HTTPS'] is absent by esetnik · Pull Request #2638 · simplesamlphp/simplesamlphp

esetnik · 2026-05-26T04:37:08Z

Make `baseurlpath`'s HTTPS declaration apply consistently in `getServerHTTPS()`

Problem

Utils\HTTP::getServerHTTPS() consults only $_SERVER['HTTPS']. In nginx → php-fpm deployments behind a TLS-terminating reverse proxy, $_SERVER['HTTPS'] is absent — nginx's stock fastcgi_params ships fastcgi_param HTTPS $https if_not_empty;, and $https is empty when nginx itself receives plain HTTP from the upstream proxy. So getServerHTTPS() returns false for what is actually an HTTPS request, breaking five downstream call sites:

Caller	Symptom of the bug
`Utils\HTTP::getSelfURL()` external-script branch	`$as = new \SimpleSAML\Auth\Simple(…)` from a host application's own controller throws `CriticalConfigurationError: Setting secure cookie on plain HTTP` (the most visible failure mode)
`Auth\Simple::getProcessedURL()`	Returns `http://...` return-to URLs even when the original request was HTTPS
`Utils\HTTP::getServerPort()`	Defaults to port 80 instead of 443 when `SERVER_PORT` is missing
`Utils\HTTP::getBaseURL()` relative-path branch	Builds the auto-detected base URL with `http://` instead of `https://` when baseurlpath is a relative path

The maintainer-prescribed workaround for reverse-proxy deployments — set baseurlpath to a full https:// URL, restated multiple times in #795, #376, #324, #491 — works for Utils\HTTP::getBaseURL()'s full-URL branch (used by the "normal" branch of getSelfURL() for SimpleSAMLphp's own /saml/* URLs) but is silently ignored by getServerHTTPS() and therefore by the four other callers above.

For SPs that use the canonical Auth\Simple pattern from a host application's own controller, the maintainer's verbal guidance in #2484 is "also set application.baseURL." That works, but it's not documented in the config template, the SP documentation, or the error message — users repeatedly burn hours discovering it (a decade of duplicate reports: #77, #343, #654, #808, #879, #2484).

Approach

Threads the maintainer-stated philosophy explicitly:

Do not trust client-supplied X-Forwarded-* headers. Consistent with the position taken in #795, #376, #324, and #491.
Trust admin-set configuration. baseurlpath is set in config.php by the deployment administrator — this is the same source of truth the maintainers have repeatedly endorsed.
Preserve every existing semantic. When $_SERVER['HTTPS'] is present (set or 'off'), behavior is byte-for-byte unchanged. The new fallback only activates when the key is absent.
Conservative host match. Only trust baseurlpath's declared scheme when its host exactly matches the current request's host (case-insensitive). Prevents a multi-host installation from over-promoting unrelated requests to HTTPS just because one configured vhost happens to declare HTTPS.

Changes

`src/SimpleSAML/Utils/HTTP.php` — `getServerHTTPS()`

Refactored so the original three-case $_SERVER['HTTPS'] interpretation runs only when array_key_exists('HTTPS', $_SERVER). When the key is absent, falls through to a new admin-config-based check:

public function getServerHTTPS(): bool
{
    if (array_key_exists('HTTPS', $_SERVER)) {
        if ($_SERVER['HTTPS'] === 'off') {
            return false;
        }
        return !empty($_SERVER['HTTPS']);
    }

    try {
        $cfg = Configuration::getInstance();
    } catch (\Exception $e) {
        return false;
    }

    $baseURL = $cfg->getOptionalString('baseurlpath', null);
    if (
        $baseURL !== null
        && preg_match('#^https://([^/:]+)(?::([0-9]+))?#', $baseURL, $matches)
    ) {
        $configuredHost = strtolower($matches[1]);
        $currentHost = strtolower($this->getServerHost());
        if ($configuredHost === $currentHost) {
            return true;
        }
    }

    return false;
}

`tests/src/SimpleSAML/Utils/HTTPTest.php` — 8 new test methods

Test	Asserts
`testGetServerHTTPSHonorsHttpsBaseurlpathBehindProxy`	The bug — fails on master without the fix, passes with it
`testGetServerHTTPSBaseurlpathHostMismatchDoesNotForceHTTPS`	Host-match guard rejects cross-host baseurlpath
`testGetServerHTTPSReturnsTrueWhenHttpsEnvIsSet`	Branch A short-circuit preserved (HTTPS=on with conflicting baseurlpath still returns true)
`testGetServerHTTPSRespectsExplicitHttpsOff`	IIS-style explicit `HTTPS=off` is not overridden by fallback
`testGetServerHTTPSCaseInsensitiveHostMatch`	Host comparison is case-insensitive (DNS rule)
`testGetServerHTTPSHostWithPortInRequest`	`HTTP_HOST` with port matches baseurlpath without port (port stripped by `getServerHost()`)
`testGetServerHTTPSIgnoresRelativeBaseurlpath`	Default relative-path baseurlpath doesn't trigger the fallback
`testGetServerHTTPSIgnoresHttpBaseurlpath`	`http://` baseurlpath is not coerced into HTTPS

Verification

vendor/bin/phpunit --no-coverage
...
Tests: 888, Assertions: 2633, Warnings: 1, PHPUnit Notices: 24, Skipped: 11.

880 → 888 tests, all pass (8 added, 0 regressions).
The new bug-demonstration test fails on unmodified master:

Failed asserting that false is true. at testGetServerHTTPSHonorsHttpsBaseurlpathBehindProxy
The same test passes after the patch is applied.
All 4 other getServerHTTPS() callers in the library benefit: getServerPort(), getBaseURL()'s relative-path branch, getSelfURL()'s external-script branch (the bug site), and Auth\Simple::getProcessedURL().

Backward compatibility

Pre-existing scenario	Behavior on master	Behavior with this PR
`$_SERVER['HTTPS']='on'`	true	true (unchanged)
`$_SERVER['HTTPS']='off'`	false	false (unchanged — explicit off still wins)
`$_SERVER['HTTPS']=''`	false (empty string check)	false (unchanged)
`$_SERVER['HTTPS']` missing, no baseurlpath / relative baseurlpath	false	false (unchanged)
`$_SERVER['HTTPS']` missing, http:// baseurlpath	false	false (unchanged — http baseurlpath rejected)
`$_SERVER['HTTPS']` missing, https:// baseurlpath, different host	false	false (unchanged — host-match guard rejects)
`$_SERVER['HTTPS']` missing, https:// baseurlpath, same host	false (THE BUG)	true (FIXED)

Production deployments that already set application.baseURL as a workaround are unaffected — getSelfURL()'s external branch checks that first.

Security considerations

The new fallback never reads any client-controlled header. The two inputs are:

baseurlpath from Configuration (admin-set in config.php).
$_SERVER['HTTP_HOST'] via getServerHost() (already used by the library; getServerHost() strips any port and falls back to SERVER_NAME / 'localhost').

There is no widening of the trust surface; the change is strictly within the library's existing trust model.

Reproducer

A self-contained Docker Compose reproducer is attached to the linked issue. Tear-down command included.

…TPS'] is absent When SimpleSAMLphp is invoked from an external script (e.g. via \SimpleSAML\Auth\Simple from a host application's controller) behind a TLS-terminating upstream proxy, $_SERVER['HTTPS'] is absent in PHP -- nginx's stock fastcgi_params ships `fastcgi_param HTTPS $https if_not_empty;`, and $https is empty when nginx itself receives a plain HTTP connection from the upstream proxy. In that topology getServerHTTPS() returns false for what is actually an HTTPS request, which cascades through five callers -- most visibly via Session::getSessionFromRequest() throwing CriticalConfigurationError ('Setting secure cookie on plain HTTP') from the secure-cookie check. The maintainer-prescribed workaround for reverse-proxy deployments (see PRs simplesamlphp#795, simplesamlphp#376, simplesamlphp#324, simplesamlphp#491) is to set baseurlpath to a full URL. That works for Utils\HTTP::getBaseURL()'s full-URL branch but is silently ignored by getServerHTTPS() and its four downstream callers. This change has getServerHTTPS() consult the admin-set baseurlpath as a secondary signal -- but only when: (a) $_SERVER['HTTPS'] is COMPLETELY ABSENT (preserves explicit 'off') (b) baseurlpath is a full https:// URL (c) baseurlpath's host exactly matches the current request's host (case-insensitive) No client-controlled header (X-Forwarded-Proto etc.) is read at any point -- consistent with the maintainer position taken in PRs simplesamlphp#795, simplesamlphp#376, simplesamlphp#324, and simplesamlphp#491. Adds 8 PHPUnit tests covering: the bug demonstration, the host-match guard, the HTTPS=on short-circuit, explicit HTTPS=off preservation, case-insensitive host comparison, host-with-port in the request, relative-path baseurlpath rejection, and http:// baseurlpath rejection. Verified against upstream master: 880 -> 888 tests, 0 regressions.

codecov · 2026-05-26T04:38:50Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 45.91%. Comparing base (62eb4a8) to head (8c11988).
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #2638      +/-   ##
============================================
+ Coverage     45.80%   45.91%   +0.11%     
- Complexity     4256     4259       +3     
============================================
  Files           184      184              
  Lines         13696    13717      +21     
============================================
+ Hits           6273     6298      +25     
+ Misses         7423     7419       -4

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

PHPCS reported 8 violations from PR simplesamlphp#2638 — 7x 'Expected 2 blank lines after method, found 1' and 1x 'closing brace for the class must go on the next line after the body'. Auto-fixed by phpcbf. No behavioral change; all 888 unit tests still pass.

`getBaseURL()` (same file) calls `Configuration::getInstance()` without a try/catch; the new `getServerHTTPS()` fallback should follow the same pattern for consistency. The catch's `return false` was untested (would require Configuration to throw, which it doesn't in normal operation) — codecov flagged it as the 1 line of missing patch coverage on PR simplesamlphp#2638.

esetnik · 2026-05-26T05:59:43Z

Re: codecov 92.85% patch coverage — the 1 uncovered line was a defensive try/catch around Configuration::getInstance() that didn't match the rest of HTTP.php (e.g., getBaseURL() calls Configuration::getInstance() without a try/catch). Removed it in 171f6924a — patch coverage should now be 100%.

tvdijen · 2026-05-26T10:46:39Z

LGTM! @thijskh would you mind taking a look before I merge this?
We've had tons of issues in the past with changes like this, so a second pair of eyes never hurts.

thijskh · 2026-05-29T08:53:21Z

It looks like a valid improvement. Given the various decisions based on different variables, I wonder if adding some debug-level logging would help. So if deployers do not get the URL they expect, they can know what triggered SSP to conclude or not that it is HTTPS.

tvdijen · 2026-05-29T09:00:33Z

Makes sense! @esetnik is this something you can add for us, please?

@thijskh

Per review feedback (@thijskh): when $_SERVER['HTTPS'] is absent and getServerHTTPS() falls back to the baseurlpath check, log a debug-level line explaining which variable drove the HTTPS-or-not conclusion, so deployers who don't get the URL they expect can diagnose it. Three distinct debug lines cover the three fallback outcomes: - baseurlpath host matches current host -> treated as HTTPS - baseurlpath host does NOT match -> not HTTPS (names both hosts) - baseurlpath is not a full https:// URL -> not HTTPS, with a hint to set baseurlpath/application.baseURL for upstream-TLS-terminating deployments Logging is confined to the new fallback branch; the pre-existing $_SERVER['HTTPS'] cases are unchanged and unlogged to avoid noise on the common path. All three lines are exercised by existing tests.

esetnik · 2026-05-29T09:01:06Z

Good call — added in 8c11988. When $_SERVER['HTTPS'] is absent and getServerHTTPS() falls back to the baseurlpath check, it now emits a debug-level line for each of the three outcomes:

baseurlpath host matches the current host → treated as HTTPS (names the host)
baseurlpath host does not match → not HTTPS (names both hosts — this is the "deployer expected a URL but didn't get it" case)
baseurlpath isn't a full https:// URL → not HTTPS, with a hint to set baseurlpath/application.baseURL for upstream-TLS-terminating deployments

I kept the logging to the new fallback branch only — the pre-existing $_SERVER['HTTPS'] paths are unchanged and unlogged, since getServerHTTPS() is called several times per request and logging the common path would just be noise. All three lines are covered by the existing tests.

esetnik · 2026-05-29T09:03:43Z

@tvdijen already added it in 8c11988 (our comments crossed) — debug logging on each of the three baseurlpath-fallback outcomes, scoped to the new branch only.

One thing I can't fix from a fork: the PHP-Linter (8.4) job failed on a transient GitHub API rate limit fetching the overtrue/phplint PHAR, not on anything in the diff:

[WARNING] GitHub API Rate Limit exceeded - cannot resolve "overtrue/phplint"
[ERROR]   Could not resolve requested PHAR overtrue/phplint

PHP-Linter on 8.3 and 8.5 passed on the same commit (run 26628316432). Could one of you re-run the failed job when convenient? gh run rerun needs repo admin rights, which I don't have on the fork.

esetnik · 2026-05-29T09:11:15Z

The 8.5-ubuntu unit-test failure is also infra, not the diff: IndexTest::testRedirection / testRedirectionFrontpageRedirectOption died at BuiltInServer.php:229 with explode(): Argument #2 must be of type string, false given — i.e. curl_exec() returned false because the test's built-in PHP server wasn't reachable (the log also shows sh: 1: kill: No such process).

Evidence it's unrelated to this change:

The same two tests pass locally on this branch, and pass on 8.5-windows + 8.3 + 8.4 in this very run.
IndexTest also exercises a baseurlpath => 'https://example.org/' case (line 85) — the one most sensitive to this PR's HTTPS-detection change — and it passed. Only the two curl_exec-returned-false cases errored.

Both this and the earlier PHP-Linter (8.4) PHAR rate-limit are transient. A re-run should green the pipeline; I can't trigger it from the fork. Thanks for your patience with the flakes!

tvdijen · 2026-05-29T09:16:39Z

It's passing now.. The linters are always failing, so annoying :(

@thijskh

…TPS'] is absent (#2638) * HTTP: have getServerHTTPS() honor https baseurlpath when $_SERVER['HTTPS'] is absent When SimpleSAMLphp is invoked from an external script (e.g. via \SimpleSAML\Auth\Simple from a host application's controller) behind a TLS-terminating upstream proxy, $_SERVER['HTTPS'] is absent in PHP -- nginx's stock fastcgi_params ships `fastcgi_param HTTPS $https if_not_empty;`, and $https is empty when nginx itself receives a plain HTTP connection from the upstream proxy. In that topology getServerHTTPS() returns false for what is actually an HTTPS request, which cascades through five callers -- most visibly via Session::getSessionFromRequest() throwing CriticalConfigurationError ('Setting secure cookie on plain HTTP') from the secure-cookie check. The maintainer-prescribed workaround for reverse-proxy deployments (see PRs #795, #376, #324, #491) is to set baseurlpath to a full URL. That works for Utils\HTTP::getBaseURL()'s full-URL branch but is silently ignored by getServerHTTPS() and its four downstream callers. This change has getServerHTTPS() consult the admin-set baseurlpath as a secondary signal -- but only when: (a) $_SERVER['HTTPS'] is COMPLETELY ABSENT (preserves explicit 'off') (b) baseurlpath is a full https:// URL (c) baseurlpath's host exactly matches the current request's host (case-insensitive) No client-controlled header (X-Forwarded-Proto etc.) is read at any point -- consistent with the maintainer position taken in PRs #795, #376, #324, and #491. Adds 8 PHPUnit tests covering: the bug demonstration, the host-match guard, the HTTPS=on short-circuit, explicit HTTPS=off preservation, case-insensitive host comparison, host-with-port in the request, relative-path baseurlpath rejection, and http:// baseurlpath rejection. Verified against upstream master: 880 -> 888 tests, 0 regressions. * tests: fix PSR-12 spacing (2 blank lines after methods) PHPCS reported 8 violations from PR #2638 — 7x 'Expected 2 blank lines after method, found 1' and 1x 'closing brace for the class must go on the next line after the body'. Auto-fixed by phpcbf. No behavioral change; all 888 unit tests still pass. * HTTP: drop defensive try/catch around Configuration::getInstance() `getBaseURL()` (same file) calls `Configuration::getInstance()` without a try/catch; the new `getServerHTTPS()` fallback should follow the same pattern for consistency. The catch's `return false` was untested (would require Configuration to throw, which it doesn't in normal operation) — codecov flagged it as the 1 line of missing patch coverage on PR #2638. * HTTP: add debug logging to getServerHTTPS() baseurlpath fallback Per review feedback (@thijskh): when $_SERVER['HTTPS'] is absent and getServerHTTPS() falls back to the baseurlpath check, log a debug-level line explaining which variable drove the HTTPS-or-not conclusion, so deployers who don't get the URL they expect can diagnose it. Three distinct debug lines cover the three fallback outcomes: - baseurlpath host matches current host -> treated as HTTPS - baseurlpath host does NOT match -> not HTTPS (names both hosts) - baseurlpath is not a full https:// URL -> not HTTPS, with a hint to set baseurlpath/application.baseURL for upstream-TLS-terminating deployments Logging is confined to the new fallback branch; the pre-existing $_SERVER['HTTPS'] cases are unchanged and unlogged to avoid noise on the common path. All three lines are exercised by existing tests.

@thijskh

…TPS'] is absent (#2638) * HTTP: have getServerHTTPS() honor https baseurlpath when $_SERVER['HTTPS'] is absent When SimpleSAMLphp is invoked from an external script (e.g. via \SimpleSAML\Auth\Simple from a host application's controller) behind a TLS-terminating upstream proxy, $_SERVER['HTTPS'] is absent in PHP -- nginx's stock fastcgi_params ships `fastcgi_param HTTPS $https if_not_empty;`, and $https is empty when nginx itself receives a plain HTTP connection from the upstream proxy. In that topology getServerHTTPS() returns false for what is actually an HTTPS request, which cascades through five callers -- most visibly via Session::getSessionFromRequest() throwing CriticalConfigurationError ('Setting secure cookie on plain HTTP') from the secure-cookie check. The maintainer-prescribed workaround for reverse-proxy deployments (see PRs #795, #376, #324, #491) is to set baseurlpath to a full URL. That works for Utils\HTTP::getBaseURL()'s full-URL branch but is silently ignored by getServerHTTPS() and its four downstream callers. This change has getServerHTTPS() consult the admin-set baseurlpath as a secondary signal -- but only when: (a) $_SERVER['HTTPS'] is COMPLETELY ABSENT (preserves explicit 'off') (b) baseurlpath is a full https:// URL (c) baseurlpath's host exactly matches the current request's host (case-insensitive) No client-controlled header (X-Forwarded-Proto etc.) is read at any point -- consistent with the maintainer position taken in PRs #795, Adds 8 PHPUnit tests covering: the bug demonstration, the host-match guard, the HTTPS=on short-circuit, explicit HTTPS=off preservation, case-insensitive host comparison, host-with-port in the request, relative-path baseurlpath rejection, and http:// baseurlpath rejection. Verified against upstream master: 880 -> 888 tests, 0 regressions. * tests: fix PSR-12 spacing (2 blank lines after methods) PHPCS reported 8 violations from PR #2638 — 7x 'Expected 2 blank lines after method, found 1' and 1x 'closing brace for the class must go on the next line after the body'. Auto-fixed by phpcbf. No behavioral change; all 888 unit tests still pass. * HTTP: drop defensive try/catch around Configuration::getInstance() `getBaseURL()` (same file) calls `Configuration::getInstance()` without a try/catch; the new `getServerHTTPS()` fallback should follow the same pattern for consistency. The catch's `return false` was untested (would require Configuration to throw, which it doesn't in normal operation) — codecov flagged it as the 1 line of missing patch coverage on PR #2638. * HTTP: add debug logging to getServerHTTPS() baseurlpath fallback Per review feedback (@thijskh): when $_SERVER['HTTPS'] is absent and getServerHTTPS() falls back to the baseurlpath check, log a debug-level line explaining which variable drove the HTTPS-or-not conclusion, so deployers who don't get the URL they expect can diagnose it. Three distinct debug lines cover the three fallback outcomes: - baseurlpath host matches current host -> treated as HTTPS - baseurlpath host does NOT match -> not HTTPS (names both hosts) - baseurlpath is not a full https:// URL -> not HTTPS, with a hint to set baseurlpath/application.baseURL for upstream-TLS-terminating deployments Logging is confined to the new fallback branch; the pre-existing $_SERVER['HTTPS'] cases are unchanged and unlogged to avoid noise on the common path. All three lines are exercised by existing tests.

@thijskh

…TPS'] is absent (#2638) * HTTP: have getServerHTTPS() honor https baseurlpath when $_SERVER['HTTPS'] is absent When SimpleSAMLphp is invoked from an external script (e.g. via \SimpleSAML\Auth\Simple from a host application's controller) behind a TLS-terminating upstream proxy, $_SERVER['HTTPS'] is absent in PHP -- nginx's stock fastcgi_params ships `fastcgi_param HTTPS $https if_not_empty;`, and $https is empty when nginx itself receives a plain HTTP connection from the upstream proxy. In that topology getServerHTTPS() returns false for what is actually an HTTPS request, which cascades through five callers -- most visibly via Session::getSessionFromRequest() throwing CriticalConfigurationError ('Setting secure cookie on plain HTTP') from the secure-cookie check. The maintainer-prescribed workaround for reverse-proxy deployments (see PRs #795, #376, #324, #491) is to set baseurlpath to a full URL. That works for Utils\HTTP::getBaseURL()'s full-URL branch but is silently ignored by getServerHTTPS() and its four downstream callers. This change has getServerHTTPS() consult the admin-set baseurlpath as a secondary signal -- but only when: (a) $_SERVER['HTTPS'] is COMPLETELY ABSENT (preserves explicit 'off') (b) baseurlpath is a full https:// URL (c) baseurlpath's host exactly matches the current request's host (case-insensitive) No client-controlled header (X-Forwarded-Proto etc.) is read at any point -- consistent with the maintainer position taken in PRs #795, #376, #324, and #491. Adds 8 PHPUnit tests covering: the bug demonstration, the host-match guard, the HTTPS=on short-circuit, explicit HTTPS=off preservation, case-insensitive host comparison, host-with-port in the request, relative-path baseurlpath rejection, and http:// baseurlpath rejection. Verified against upstream master: 880 -> 888 tests, 0 regressions. * tests: fix PSR-12 spacing (2 blank lines after methods) PHPCS reported 8 violations from PR #2638 — 7x 'Expected 2 blank lines after method, found 1' and 1x 'closing brace for the class must go on the next line after the body'. Auto-fixed by phpcbf. No behavioral change; all 888 unit tests still pass. * HTTP: drop defensive try/catch around Configuration::getInstance() `getBaseURL()` (same file) calls `Configuration::getInstance()` without a try/catch; the new `getServerHTTPS()` fallback should follow the same pattern for consistency. The catch's `return false` was untested (would require Configuration to throw, which it doesn't in normal operation) — codecov flagged it as the 1 line of missing patch coverage on PR #2638. * HTTP: add debug logging to getServerHTTPS() baseurlpath fallback Per review feedback (@thijskh): when $_SERVER['HTTPS'] is absent and getServerHTTPS() falls back to the baseurlpath check, log a debug-level line explaining which variable drove the HTTPS-or-not conclusion, so deployers who don't get the URL they expect can diagnose it. Three distinct debug lines cover the three fallback outcomes: - baseurlpath host matches current host -> treated as HTTPS - baseurlpath host does NOT match -> not HTTPS (names both hosts) - baseurlpath is not a full https:// URL -> not HTTPS, with a hint to set baseurlpath/application.baseURL for upstream-TLS-terminating deployments Logging is confined to the new fallback branch; the pre-existing $_SERVER['HTTPS'] cases are unchanged and unlogged to avoid noise on the common path. All three lines are exercised by existing tests.

esetnik added 2 commits May 26, 2026 01:57

tvdijen requested a review from thijskh May 26, 2026 10:45

tvdijen merged commit d35d396 into simplesamlphp:master May 29, 2026
46 of 48 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

HTTP: have getServerHTTPS() honor https baseurlpath when $_SERVER['HTTPS'] is absent#2638

HTTP: have getServerHTTPS() honor https baseurlpath when $_SERVER['HTTPS'] is absent#2638
tvdijen merged 4 commits into
simplesamlphp:masterfrom
esetnik:fix/getserverhttps-honor-baseurlpath

esetnik commented May 26, 2026

Uh oh!

codecov Bot commented May 26, 2026 •

edited

Loading

Uh oh!

esetnik commented May 26, 2026

Uh oh!

tvdijen commented May 26, 2026

Uh oh!

thijskh commented May 29, 2026

Uh oh!

tvdijen commented May 29, 2026

Uh oh!

esetnik commented May 29, 2026

Uh oh!

esetnik commented May 29, 2026

Uh oh!

esetnik commented May 29, 2026

Uh oh!

tvdijen commented May 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

esetnik commented May 26, 2026

Make baseurlpath's HTTPS declaration apply consistently in getServerHTTPS()

Problem

Approach

Changes

src/SimpleSAML/Utils/HTTP.php — getServerHTTPS()

tests/src/SimpleSAML/Utils/HTTPTest.php — 8 new test methods

Verification

Backward compatibility

Security considerations

Reproducer

Uh oh!

codecov Bot commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

esetnik commented May 26, 2026

Uh oh!

tvdijen commented May 26, 2026

Uh oh!

thijskh commented May 29, 2026

Uh oh!

tvdijen commented May 29, 2026

Uh oh!

esetnik commented May 29, 2026

Uh oh!

esetnik commented May 29, 2026

Uh oh!

esetnik commented May 29, 2026

Uh oh!

tvdijen commented May 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Make `baseurlpath`'s HTTPS declaration apply consistently in `getServerHTTPS()`

`src/SimpleSAML/Utils/HTTP.php` — `getServerHTTPS()`

`tests/src/SimpleSAML/Utils/HTTPTest.php` — 8 new test methods

codecov Bot commented May 26, 2026 •

edited

Loading