hsxtxxcykcds2026-backend/app/Http/Middleware/TrustProxies.php

<?php

namespace App\Http\Middleware;

use Illuminate\Http\Middleware\TrustProxies as Middleware;
use Illuminate\Http\Request;

class TrustProxies extends Middleware
{
    /**
     * The trusted proxies for this application.
     *
     * @var array<int, string>|string|null
     */
    protected $proxies;

    /**
     * The headers that should be used to detect proxies.
     *
     * @var int
     */
    protected $headers =
        Request::HEADER_X_FORWARDED_FOR |
        Request::HEADER_X_FORWARDED_HOST |
        Request::HEADER_X_FORWARDED_PORT |
        Request::HEADER_X_FORWARDED_PROTO |
        Request::HEADER_X_FORWARDED_AWS_ELB;

    public function handle($request, \Closure $next)
    {
        // 本地 APP_URL 为 http 时不信任 X-Forwarded-Proto，避免首页/登录链接被拼成 https
        $this->proxies = str_starts_with((string) config('app.url'), 'https://') ? '*' : [];

        return parent::handle($request, $next);
    }
}