No CSS being loaded and base href on http (self hosted)

[cyavu]

Support guidelines

• I've read the support guidelines
• My request is not listed as a very good idea, but unfortunately...
• I've used the search and this has not been requested before.

Description

So there have been multiple issues over the past years of users reporting that no CSS is being loaded or the base href being on 'http' instead of 'https'. The help page also suggests (here) that setting TRUSTED_PROXIES to * should fix this, but this doesn't apply to self hosted instances where that parameter does nothing.

Not having CSS loaded and the base href being on http will prevent your browser you from logging in, flagging it as insecure.

Solution

The solution is to add

if($this->app->environment('production')) {
    \URL::forceScheme('https');
}

to app/Providers/AppServiceProvider.php so the code looks like the following:

class AppServiceProvider extends ServiceProvider
{
    /**
     * Bootstrap any application services.
     */
    public function boot(): void
    {
if($this->app->environment('production')) {
    \URL::forceScheme('https');
}

Remove the if statement if your env is set to 'testing' or you want to load it unconditionally. Otherwise, change your env to production.

You could, optionally, add a ASSET_URL at the top of your .env and that alone will fix the CSS issues, not the base href being loaded on http.

Perhaps the devs could include this, since you'll have to repeat these steps after every update. The same applies to the data-importer.

What are alternatives?

No response

Additional context

No response

[JC5]

Hi, thanks for opening an issue.

This will not happen, thanks for the suggestion though. A correctly configured web server will have no problem serving https urls.

[cyavu]

Hi, thanks for opening an issue.

This will not happen, thanks for the suggestion though. A correctly configured web server will have no problem serving https urls.

Hi JC5,

Thank you for your reply.

It did with me, though. I've been using Firefly for a year now and this started with some versions earlier, can't really tell when exactly. I assume most people just run Firefly within Docker and never had to deal with this.

[JC5]

Forcing the protocol is a bit of a hack and it's an opening for more problems down the line. What's your setup like?

[cyavu]

Forcing the protocol is a bit of a hack and it's an opening for more problems down the line. What's your setup like?

True, hence I am open to alternatives as this is not the nicest way of doing things. I'm running plain Apache + MySQL with no nginx.

[atb00ker]

I just ran into the same error here is some details:
Happens on APP_ENV=production

1. If I set TRUSTED_PROXIES=**, it works.
2. If I set TRUSTED_PROXIES to bank.example.com or https://bank.example.com , it sets the baseurl in html body to http://... causing the issue.

Here is my nginx block:

    ...
    http2           on;
    listen 443      ssl;
    listen [::]:443 ssl;
    server_name     bank.example.com;

    # upstream
    set $upstream_firefly firefly:8080;

   ...
    location / {
        proxy_pass http://$upstream_firefly;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

Am I doing something stoopid or is it an error? 🤔

[JC5]

Yeah don't do that. The TRUSTED_PROXIES environment variable tells the Docker container which reverse proxy to trust. It only accepts * (or **) or an IP address.

[atb00ker]

Super. Worked, I'll go learn to read instructions properly now. 😂