From 7eb2751cd4d67a3457023597f7e6fa6f6eb6c9a2 Mon Sep 17 00:00:00 2001
From: Brian Fertig <brian.fertig@bio-techne.com>
Date: Thu, 6 Aug 2026 12:48:42 -0600
Subject: [PATCH] http vs https handling on swagger

---
 src/bootstrap/app.php | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/bootstrap/app.php b/src/bootstrap/app.php
index fe445d7..8896976 100644
--- a/src/bootstrap/app.php
+++ b/src/bootstrap/app.php
@@ -18,6 +18,13 @@ return Application::configure(basePath: dirname(__DIR__))
 
         $middleware->redirectGuestsTo('/login');
         $middleware->redirectUsersTo('/');
+
+        // The app container only ever serves plain HTTP; TLS is terminated by an
+        // upstream reverse proxy/load balancer. Without trusting that proxy,
+        // Laravel ignores its X-Forwarded-Proto header and generates http://
+        // URLs (e.g. via asset()) even when the site is loaded over https://,
+        // which trips browsers' mixed-content blocking (seen on /api/docs).
+        $middleware->trustProxies(at: '*');
     })
     ->withExceptions(function (Exceptions $exceptions): void {
         //