From 49db9b23d6f652945c9de173869fd8cd835d4049 Mon Sep 17 00:00:00 2001
From: Brian O'Kelley <bokelley@scope3.com>
Date: Fri, 12 Sep 2025 14:32:54 +0200
Subject: [PATCH] fix: eliminate HTTP redirect in URL normalization
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add absolute_redirect off to prevent HTTP downgrades
- Add explicit trailing slash handling with proper HTTPS scheme
- Ensures all redirects maintain HTTPS protocol from load balancer
- Fixes intermediate HTTP redirect when accessing URLs without trailing slash

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 nginx.conf | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/nginx.conf b/nginx.conf
index f5ee25bbad..80d6c14140 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -52,6 +52,9 @@ http {
         if ($http_x_forwarded_proto = 'https') {
             set $real_scheme https;
         }
+        
+        # Force HTTPS in absolute redirects
+        absolute_redirect off;
 
         # Security headers
         add_header X-Frame-Options "SAMEORIGIN" always;
@@ -65,6 +68,14 @@ http {
             add_header Cache-Control "public, immutable";
         }
 
+        # Handle trailing slash redirects with proper scheme
+        location ~ ^([^.]*[^/])$ {
+            if (-d $document_root$1/) {
+                return 301 $real_scheme://$host$1/;
+            }
+            try_files $uri /index.html;
+        }
+        
         # Handle client-side routing for SPA
         location / {
             try_files $uri $uri/ /index.html;