Fix api proxy requests

[cemreinanc]

Summary by CodeRabbit

• Bug Fixes

  • Reduces contradictory scheme header warnings and improves proxy reliability by excluding conflicting scheme headers.

• Tests

  • Added a new test file to increase coverage.

• Chores

  • Updated proxy/nginx and server settings to prefer the incoming request scheme and explicitly clear conflicting scheme headers for more stable upstream requests.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds scheme-related header filtering in the API proxy, updates Nginx to prefer incoming X-Forwarded-Proto and clear conflicting scheme headers, adds ".fly.dev" to Django ALLOWED_HOSTS, and introduces a small test file.

Changes

Cohort / File(s)	Summary
API proxy header filtering front_end/src/app/(api)/api-proxy/[...path]/route.ts	Adds additional scheme-related headers to the blocklist so they are excluded from forwarded request headers: x-forwarded-ssl, x-forwarded-scheme, x-scheme, x-url-scheme, and forwarded. No other control-flow or exported API changes.
Nginx map and template scripts/nginx/etc/nginx/http.d/app_nginx.template	Adds a map to prefer incoming X-Forwarded-Proto for determining the request scheme and exposes $proxy_x_forwarded_proto.
Nginx proxy params scripts/nginx/etc/nginx/proxy_params	Switches X-Forwarded-Proto to use $proxy_x_forwarded_proto, and clears potential conflicting headers by setting X-Forwarded-Ssl, X-Forwarded-Scheme, X-Url-Scheme, and Forwarded to empty values.
Django settings metaculus_web/settings.py	Adds ".fly.dev" to ALLOWED_HOSTS to permit Fly preview domains.
Test file test-file	New file added with content test-content-v2 (no newline at end).

Sequence Diagram(s)

(Skipped — changes are configuration/header-filter tweaks and do not introduce new multi-component control flow requiring a diagram.)

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 I tidied headers, stilled a scheme,
Mapped the proto to catch the stream,
Cleared the echoes none should send,
Let previews hop to meet a friend,
A tiny test — a joyful beam.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Fix api proxy requests' directly relates to the main changeset, which addresses scheme-related headers in API proxy configuration across multiple files (route handler, Nginx templates, and Django settings) to fix the 'Contradictory scheme headers' warning.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

---

📜 Recent review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 80275fa and b849a45.

📒 Files selected for processing (1)

• metaculus_web/settings.py

🚧 Files skipped from review as they are similar to previous changes (1)

• metaculus_web/settings.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Fix all issues with AI agents

In @front_end/src/app/(api)/api-proxy/[...path]/route.ts:
- Line 45: The variable initialHeaders is assigned the iterator from
request.headers.entries(), which is single-use and logs as [object Iterator];
replace that assignment to capture a reusable, loggable array by converting the
iterator to an array (e.g., via Array.from or spread) so subsequent uses and the
log on line 88 show actual header key/value pairs while keeping the same
variable name (initialHeaders) used elsewhere in route.ts.
- Around line 85-90: The console.log call is exposing sensitive auth headers and
is iterating over header iterators (requestHeaders.entries()/initialHeaders)
which is both insecure and unreadable; remove the console.log or replace it with
a safe log that only records non-sensitive data (e.g., request.url and
targetUrl) and either omits headers entirely or logs only header names with
values redacted. Update the code that references request.url, targetUrl,
initialHeaders and requestHeaders.entries() to avoid printing full header values
(filter out Authorization, Alpha-auth tokens, Cookie/Set-Cookie, and similar
keys) or drop header logging completely; if you must debug, use a controlled
debug logger and explicitly redact sensitive header values before logging.

📜 Review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 1303c32 and ce61c24.

📒 Files selected for processing (2)

• front_end/src/app/(api)/api-proxy/[...path]/route.ts
• test-file

🔇 Additional comments (1)

test-file (1)

1-1: Verify that this file should be committed.

This file appears to be a test artifact with no clear purpose or documentation. If this was added accidentally during debugging, please remove it from the PR.

[coderabbitai]

⚠️ Potential issue | 🔴 Critical

Iterator consumed issue: initialHeaders won't display correctly.

request.headers.entries() returns an iterator that can only be consumed once. When logged on line 88, it will display [object Iterator] rather than the actual header values.

🔧 Proposed fix

Convert the iterator to an array to make it reusable and loggable:

-  const initialHeaders = request.headers.entries();
+  const initialHeaders = Array.from(request.headers.entries());

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	const initialHeaders = request.headers.entries();
	const initialHeaders = Array.from(request.headers.entries());

🤖 Prompt for AI Agents

In @front_end/src/app/(api)/api-proxy/[...path]/route.ts at line 45, The
variable initialHeaders is assigned the iterator from request.headers.entries(),
which is single-use and logs as [object Iterator]; replace that assignment to
capture a reusable, loggable array by converting the iterator to an array (e.g.,
via Array.from or spread) so subsequent uses and the log on line 88 show actual
header key/value pairs while keeping the same variable name (initialHeaders)
used elsewhere in route.ts.

[github-actions]

🧹 Preview Environment Cleaned Up

The preview environment for this PR has been destroyed.

Resource	Status
🌐 Preview App	✅ Deleted
🗄️ PostgreSQL Branch	✅ Deleted
⚡ Redis Database	✅ Deleted
🔧 GitHub Deployments	✅ Removed
📦 Docker Image	⚠️ Retained (auto-cleanup via GHCR policies)

---

Cleanup triggered by PR close at 2026-01-07T13:16:24Z

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In @metaculus_web/settings.py:
- Line 399: ALLOWED_HOSTS contains an invalid wildcard string "*.fly.dev" which
Django treats literally; update the ALLOWED_HOSTS entry for preview environments
(the ALLOWED_HOSTS list) to use the leading-dot wildcard syntax ".fly.dev"
instead of "*.fly.dev" so subdomains of fly.dev are matched correctly.

📜 Review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between ae87bfa and 80275fa.

📒 Files selected for processing (1)

• metaculus_web/settings.py

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: Build Docker Image