Running RS behind a reverse proxy? Make sure Apache/PHP knows HTTPS is on

[Tim L]

Just for general information to the community:

If you put ResourceSpace behind anything that terminates TLS in front of it

(Cloudflare Tunnel, nginx, an ALB, Caddy, etc.) and forwards plain HTTP to
Apache, remember that PHP has no idea the original connection was HTTPS.
$_SERVER['HTTPS'] stays unset, even though the browser connection is secure.

This breaks anything in RS core or its plugins that checks scheme. The one that bit
us was the SimpleSAML plugin, which won't complete login behind a
proxy until Apache is told HTTPS is on. It might affect any HTTPS-dependent behaviour in RS.

Fix: in your Apache vhost, near/inside `<VirtualHost>`, before `DocumentRoot`:

----

ServerName your.domain.tld:443

UseCanonicalName On

SetEnvIf X-Forwarded-Proto https HTTPS=on

----

This tells Apache to trust your proxy's `X-Forwarded-Proto` header and
populate the standard `HTTPS` env var PHP checks, plus pins the canonical
host/port so self-referencing URLs don't come out as `https://host:80/...`.

Only add this if you're actually behind a TLS-terminating proxy. If Apache
is serving requests directly without one, this would make RS think insecure
connections are secure, which breaks things the other way. Worth adding to
the Docker image only as an opt-in (commented out, or gated behind a build

arg/env var), not as a default for everyone.

Dockerfile. Add before "ADD cronjob...":

----

# The Cloudflare Tunnel terminates TLS and forwards to Apache over plain HTTP,
# so by default PHP thinks every request is HTTP on port 80. Trust the tunnel's
# X-Forwarded-Proto header for scheme detection (needed by SimpleSAMLphp's
# secure-cookie check), and pin the canonical server name/port to 443 so
# self-referencing URLs (e.g. SAML RelayState/ACS callback) aren't built as
# "https://host:80/..." which SimpleSAMLphp then rejects as a disallowed URL.
RUN sed -i \
    -e '/DocumentRoot \/var\/www\/html/i \\tServerName your.url.tld:443\n\tUseCanonicalName On' \
    -e '/DocumentRoot \/var\/www\/html/a \\tSetEnvIf X-Forwarded-Proto https HTTPS=on' \
    /etc/apache2/sites-enabled/000-default.conf
----