4.1.1 claims I'm not using HTTPS while --trustProxy=1; 4.1.0 does not

[mathieulb]

New Issue Checklist

• I am not disclosing a vulnerability.
• I am not just asking a question.
• I have searched through existing issues.
• I can reproduce the issue with the latest versions of Parse Server and Parse Dashboard.

Issue Description

Using Heroku, I need to run the app with --trustProxy=1, but it doesn't seem to work using Dashboard 4.1.1; the same cmdline option works with 4.0.0 and 4.1.0.

While you're at it, you could add another option (e.g. --trustProxy=2) that would check the condition req.header('x-forwarded-proto') !== 'https' for determining whether to reject.

Steps to reproduce

package.json :
{
"name": "my-parse-dashboard",
"version": "0.0.0",
"description": "",
"main": "index.js",
"scripts": {
"start": "node ./index.js --config ./parse-dashboard-config.json --trustProxy=1",
"test": "echo "Error: no test specified" && exit 1"
},
"author": "",
"license": "",
"dependencies": {
"parse-dashboard": "4.1.1"
}
}

index.js :
require('parse-dashboard/Parse-Dashboard/index.js')

Actual Outcome

"Parse Dashboard can only be remotely accessed via HTTPS" while accessing the server with a https url

Expected Outcome

seeing the login screen then being able to login and use the app

Environment

Dashboard

• Parse Dashboard version: 4.1.1
• Browser (Safari, Chrome, Firefox, Edge, etc.): Firefox
• Browser version: 100.0.1

Server

• Parse Server version: 5.2.0
• Operating system: Heroku-18 & Heroku-20
• Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc): Heroku

Database

• System (MongoDB or Postgres): Mongo
• Database version: Unknown
• Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc): ObjectRocket @ Heroku

[parse-github-assistant]

Thanks for opening this issue!

• 🚀 You can help us to fix this issue faster by opening a pull request with a failing test. See our Contribution Guide for how to make a pull request, or read our New Contributor's Guide if this is your first time contributing.

[mtrezza]

Are you able to pin down the PR / commit that causes this issue in 4.1.1?

While you're at it, you could add another option (e.g. --trustProxy=2) that would check the condition req.header('x-forwarded-proto') !== 'https' for determining whether to reject.

We'll only look at the bug report in this thread. If you want to make a feature suggestion, please open a new issue.

[mtrezza]

Closing as duplicate of #2112