Skip to content

fix: reverse proxy compatibility (header case + port 0 in mds.js)#624

Open
astowny wants to merge 2 commits intominima-global:masterfrom
astowny:fix/reverse-proxy-header-case-sensitivity
Open

fix: reverse proxy compatibility (header case + port 0 in mds.js)#624
astowny wants to merge 2 commits intominima-global:masterfrom
astowny:fix/reverse-proxy-header-case-sensitivity

Conversation

@astowny
Copy link
Copy Markdown

@astowny astowny commented Mar 23, 2026

Problem

When Minima's MDS (MiniDapp System) runs behind a reverse proxy like Traefik, nginx, or HAProxy, two bugs prevent MiniDapps from working:

Bug 1: Case-sensitive HTTP header parsing (MDSFileHandler.java)

All POST requests fail with "Connection failed: Your session is invalid".

MDSFileHandler.java stores HTTP headers with their original case but looks them up with exact case "Content-Length". Per RFC 7230 §3.2, HTTP/1.1 headers are case-insensitive, and per RFC 7540 §8.1.2, HTTP/2 mandates lowercase. When a reverse proxy forwards content-length (lowercase):

  1. allheaders.get("Content-Length")null
  2. Integer.parseInt(null)NumberFormatException
  3. Caught by generic catch(Exception) → returns invalid.html
  4. MiniDapp JS does JSON.parse(html)"Connection failed"

Bug 2: ERR_UNSAFE_PORT in MiniDapp mds.js copies

When accessing via standard HTTPS (port 443), window.location.port returns "". Math.floor("") evaluates to 0, producing URLs like https://host:0/mdscommand_/.... Browsers block port 0 → ERR_UNSAFE_PORT → black screen.

The main mds/mds.js already has the fix (if(port == 0) check), but 41 copies in mds/code/*/mds.js still had the old code.

Fixes

Commit 1: MDSFileHandler.java

Added normalizeHeaderName() that converts HTTP header names to canonical form (content-lengthContent-Length) when parsing. Follows standard HTTP convention: capitalize first letter and every letter after a hyphen.

Commit 2: mds/code/*/mds.js (41 files)

Added if(port == 0) check to omit the port from URLs when running on standard ports (443/80), matching the fix already present in the main mds/mds.js.

Testing

  • Direct access (no proxy) — ✅ works as before
  • Behind Traefik 3.x with HTTP/2 → HTTP/1.1 — ✅ both bugs fixed
  • curl with lowercase headers — ✅ handled correctly
  • Standard HTTPS port (443) — ✅ no more ERR_UNSAFE_PORT

Files Changed

  • src/org/minima/system/mds/MDSFileHandler.java — Header name normalization
  • mds/code/*/mds.js (41 files) — Port 0 handling

Econumerica added 2 commits March 23, 2026 11:53
When Minima runs behind a reverse proxy (Traefik, nginx, HAProxy),
the proxy may forward HTTP headers in lowercase (e.g. 'content-length'
instead of 'Content-Length'). This is standard behavior per:
- RFC 7230 Section 3.2: HTTP/1.1 headers are case-insensitive
- RFC 7540 Section 8.1.2: HTTP/2 mandates lowercase headers

The MDSFileHandler stores headers with their original case but looks
them up with exact case ('Content-Length'), causing a
NumberFormatException when the header is lowercase. This crashes the
request handler and returns the invalid.html error page, which the
MiniDapp JS interprets as 'Connection failed: Your session is invalid'.

The fix normalizes header names to canonical HTTP form (e.g.
'content-length' -> 'Content-Length') when parsing, ensuring
consistent lookups regardless of the proxy's header casing.
When accessing Minima through a reverse proxy on standard ports (443/80),
window.location.port returns an empty string. Math.floor('') evaluates
to 0, causing URLs like 'https://host:0/mdscommand_/...' which browsers
block with ERR_UNSAFE_PORT.

The main mds.js already had this fix, but 41 copies in individual
MiniDapps (mds/code/*) still had the old code. This commit adds
the port==0 check to all of them, omitting the port from URLs when
running on standard ports.
@astowny astowny changed the title fix: normalize HTTP header names for reverse proxy compatibility fix: reverse proxy compatibility (header case + port 0 in mds.js) Mar 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant