mixed content error on /login and can't detect origin

[getchoo]

Describe the bug i've recently started the move to hydra, and after getting distributed builds, the server, etc. setup, i came across a pretty bad problem. when trying to login, i get different behavior depending on the browser

for both browsers, the post request to /login is made with http. firefox is able to upgrade this to https and continue, however chromium fails with the following error:

Mixed Content: The page at 'https://hydra.mydomain.com/' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://hydra.mydomain.com/login'. This request has been blocked; the content must be served over HTTPS.

after firefox upgrades the connection to https, the request succeeds but i'm met with another error:

POST requests should come from ‘http://hydra.mydomain.com/’

i'm not exactly sure why it's requesting a url via http in the first place, as i have services.hydra.hydraURL set to https://hydra.mydomain.com

To Reproduce Steps to reproduce the behavior:

1. Use hydra with this configuration
2. Try to login as user
3. See errors

Expected behavior the login post request is made with https by default and succeeds

Screenshots headers of POST request/response in firefox

Hydra Server:

Please fill out this data as well as you can, but don't worry if you can't -- just do your best.

• OS and version: NixOS 22.11.20230520.7dc71ae
• Version of Hydra: 2022-10-22 (behavior is reproducible when using the package from this flake)
• Version of Nix Hydra is built against: 2.11.1
• Version of the Nix daemon: 2.11.1

Additional context hydra is proxied through nginx (with https/ssl enabled), and the domain is proxied through cloudflare. my instance with this issue can be found at https://hydra.mydadleft.me/

[getchoo]

it seems this might have also been reported here

[ajs124]

Can you try adding this header Front-End-Https: on in your reverse proxy?

[getchoo]

i just added it here, but it doesn't seem to have changed anything :(

[getchoo]

after fiddling with cloudflare, i found setting the ssl encryption mode to full resolved this. this isn't an upstream bug; sorry! :(

[srd424]

For anyone stumbling across this, #173 has some more info, as does the manual section on reverse proxies.