TP-006 – Reverse Proxy Behavior

Purpose:
Verify that the application correctly handles traffic when deployed behind a reverse proxy (e.g., Nginx), including protocol forwarding, headers, redirects, and asset loading.

✅ Steps to Validate

1. Access via Proxy URL

   • Navigate to the public-facing URL (e.g., https://wiki.example.com)

   • Confirm the site loads without redirect loops or protocol errors

2. Inspect Headers

   • Use browser dev tools or curl -I to check:

     • X-Forwarded-For

     • X-Forwarded-Proto

     • Host

   ✅ Confirm these are being passed and respected

3. Load Assets

   • Confirm that CSS, JS, and images load correctly

   • No mixed content warnings if proxy uses HTTPS

4. Login Handling

   • Log in as a user from the proxy-facing URL

   • Confirm session and redirect behavior work correctly

5. Force Redirects (if configured)

   • Access via http:// (if enabled)

   • Confirm redirection to https:// is enforced

🔐 Things to Watch For

• ❌ Mixed content warnings (HTTPS site pulling HTTP assets)

• ❌ Redirect loops (https ↔ http)

• ❌ Incorrect client IPs (caused by missing X-Forwarded-For)

• ❌ Inconsistent login behavior due to cookie domain mismatch

🧼 Bonus: Test Internal vs External Access

• Internal URL: http://localhost:3000

• External/proxy URL: https://wiki.company.com

• ✅ Ensure both work correctly in their contexts

• ✅ But public-facing users only use the proxied endpoint