fix: compare URLs without protocols with checkOrigin: lax-proto

[asaharan]

Previously, two CSRF middlewares were added for lax-proto requests: one at the beginning and one at the end. This change replaces them with a single middleware placed at the beginning. Non-lax-proto cases remain unchanged.

What is it?

• Bug

Description

fix behaviour of checkOrigin: "lax-proto" in createQwikCity

Checklist

• My code follows the developer guidelines of this project
• I performed a self-review of my own code
• I added a changeset with pnpm change

[changeset-bot]

🦋 Changeset detected

Latest commit: cc7a14c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@builder.io/qwik-city	Patch
eslint-plugin-qwik	Patch
@builder.io/qwik	Patch
create-qwik	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[gioboa]

Thanks for your help @asaharan
Is there a specific issue with the actual code?
why are we changing it?

[asaharan]

Yes @gioboa , even when I set checkOrigin to lax-proto, I get CSRF error.
ORIGIN=https://saharan.dev
Request is coming from https://saharan.dev
but there is a load balancer(say AWS ALB) in between, so it forwards x-forwarded-proto: https but still I get the CSRF error saying saying request domain https://saharan.dev doesn't match origin http://saharan.dev

lax-proto is supposed to handle this case, hence this change.

[github-actions]

built with Refined Cloudflare Pages Action

⚡ Cloudflare Pages Deployment

Name	Status	Preview	Last Commit
qwik-docs	✅ Ready (View Log)	Visit Preview	7529a70

[wmertens]

LGTM 🌉

[gioboa]

Please test the package generated by this PR and let us know if it's working as expected on your scenario. Thanks.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@builder.io/qwik@7865

npm i https://pkg.pr.new/@builder.io/qwik-city@7865

npm i https://pkg.pr.new/eslint-plugin-qwik@7865

npm i https://pkg.pr.new/create-qwik@7865

commit: cc7a14c

[asaharan]

@gioboa as csrf is being checked at the very beginning, origin contains http and not https. So, I have compare origin with inputOrigin after removing the protocol(http/https).
Have tested this on my production environment by directly modifying files inside node_modules and it's working fine over there.

[gioboa]

Nice, Thanks 👍

[gioboa]

Thanks for your help @asaharan