From c168b678dd397a6c96afaca533a708145b099c67 Mon Sep 17 00:00:00 2001
From: Baptiste Arnaud <contact@baptiste-arnaud.fr>
Date: Mon, 23 May 2022 14:51:11 -0700
Subject: [PATCH] =?UTF-8?q?fix(viewer):=20=F0=9F=90=9B=20Forwarded=20host?=
 =?UTF-8?q?=20check=20attempt?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 apps/viewer/pages/[[...publicId]].tsx | 28 +++++++++++++++++++--------
 1 file changed, 20 insertions(+), 8 deletions(-)

diff --git a/apps/viewer/pages/[[...publicId]].tsx b/apps/viewer/pages/[[...publicId]].tsx
index a4c11c947..baf6890c5 100644
--- a/apps/viewer/pages/[[...publicId]].tsx
+++ b/apps/viewer/pages/[[...publicId]].tsx
@@ -1,3 +1,4 @@
+import { IncomingMessage } from 'http'
 import { NotFoundPage } from 'layouts/NotFoundPage'
 import { PublicTypebot } from 'models'
 import { GetServerSideProps, GetServerSidePropsContext } from 'next'
@@ -11,15 +12,19 @@ export const getServerSideProps: GetServerSideProps = async (
   let typebot: Omit<PublicTypebot, 'createdAt' | 'updatedAt'> | null
   const isIE = /MSIE|Trident/.test(context.req.headers['user-agent'] ?? '')
   const pathname = context.resolvedUrl.split('?')[0]
+  const { host, forwardedHost } = getHost(context.req)
   try {
-    if (!context.req.headers.host) return { props: {} }
+    if (!host) return { props: {} }
     const viewerUrls = (process.env.NEXT_PUBLIC_VIEWER_URL ?? '').split(',')
-    const isMatchingViewerUrl = viewerUrls.some((url) =>
-      (context.req.headers.host ?? '')
-        .split(':')[0]
-        .includes(url.split('//')[1].split(':')[0])
+    const isMatchingViewerUrl = viewerUrls.some(
+      (url) =>
+        host.split(':')[0].includes(url.split('//')[1].split(':')[0]) ||
+        (forwardedHost &&
+          forwardedHost
+            .split(':')[0]
+            .includes(url.split('//')[1].split(':')[0]))
     )
-    const customDomain = `${context.req.headers.host}${
+    const customDomain = `${forwardedHost ?? host}${
       pathname === '/' ? '' : pathname
     }`
     typebot = isMatchingViewerUrl
@@ -35,7 +40,7 @@ export const getServerSideProps: GetServerSideProps = async (
       props: {
         typebot,
         isIE,
-        url: `https://${context.req.headers.host}${pathname}`,
+        url: `https://${forwardedHost ?? host}${pathname}`,
       },
     }
   } catch (err) {
@@ -44,7 +49,7 @@ export const getServerSideProps: GetServerSideProps = async (
   return {
     props: {
       isIE,
-      url: `https://${context.req.headers.host}${pathname}`,
+      url: `https://${forwardedHost ?? host}${pathname}`,
     },
   }
 }
@@ -66,6 +71,13 @@ const getTypebotFromCustomDomain = async (customDomain: string) => {
   return omit(typebot as unknown as PublicTypebot, 'createdAt', 'updatedAt')
 }
 
+const getHost = (
+  req?: IncomingMessage
+): { host?: string; forwardedHost?: string } => ({
+  host: req?.headers ? req.headers.host : window.location.host,
+  forwardedHost: req?.headers['x-forwarded-host'] as string | undefined,
+})
+
 const App = ({ typebot, ...props }: TypebotPageProps) =>
   isDefined(typebot) ? (
     <TypebotPage typebot={typebot} {...props} />