fix duplicate redirect
rabbitprincess committed
Mar 2, 2026 at 12:13 UTC
6b22a12a0a2c639df52b920f76b26bf9ca8fe2c8
1 file changed
+10
-3
cmd/relay-server/serve.go
+10
-3
@@ -112,9 +112,16 @@ func serveAPI(addr string, serv *portal.RelayServer, admin *Admin, frontend *Fro
112
proxyToHTTP(w, r, serv, leaseName, leaseEntry)
113
return
114
}
115
- // TLS is enabled, redirect to HTTPS.
116
- log.Debug().Str("host", r.Host).Msg("[server] redirecting to HTTPS")
117
- redirectToHTTPS(w, r, serv.GetSNIRouter().GetAddr())
115
+ // TLS-enabled subdomains should terminate on SNI passthrough.
116
+ // Redirect only insecure requests; secure requests here would loop.
117
+ if !isSecureRequest(r) {
118
+ log.Debug().Str("host", r.Host).Msg("[server] redirecting to HTTPS")
119
+ redirectToHTTPS(w, r, serv.GetSNIRouter().GetAddr())
120
+ return
121
+ }
122
+
123
+ log.Warn().Str("host", r.Host).Msg("[server] tls subdomain reached admin listener without SNI route")
124
+ http.Error(w, "tls-enabled subdomain must be served via SNI route", http.StatusBadGateway)
125
return
126
}
127
appMux.ServeHTTP(w, r)