Register the endpoints list without a trailing slash, and stop hiding its errors

shopdb/__init__.py

@@ -131,6 +131,28 @@ def create_app(config_name: str = None) -> Flask:
         if envname.startswith('COLLECTOR_API_KEY_') and envvalue:
             app.config[envname] = envvalue
 
+    # Behind a reverse proxy (IIS at /shopdb, nginx, a load balancer), the app
+    # sees the PROXY's connection, not the browser's: scheme http even though
+    # the user is on https, the proxy's host, the proxy's IP. Anything Flask
+    # builds from that is wrong at the browser - an absolute redirect Location
+    # above all, which is how a trailing-slash redirect on the endpoints list
+    # sent an https page to an http URL the browser then refused to follow.
+    #
+    # OFF BY DEFAULT AND DELIBERATELY. ProxyFix makes the app TRUST
+    # X-Forwarded-* headers, and a client can send those itself. Enabled with no
+    # proxy in front, any caller can claim a different scheme or source IP -
+    # which matters here because the login rate limit and the lockout are keyed
+    # on the client address. Set TRUSTED_PROXY_COUNT to the number of proxies
+    # actually in front of this instance (1 for a single IIS or nginx), and only
+    # when one really is.
+    proxycount = app.config.get('TRUSTED_PROXY_COUNT', 0)
+    if proxycount:
+        from werkzeug.middleware.proxy_fix import ProxyFix
+        app.wsgi_app = ProxyFix(
+            app.wsgi_app,
+            x_for=proxycount, x_proto=proxycount,
+            x_host=proxycount, x_prefix=proxycount)
+
     # Ensure instance folder exists
     os.makedirs(app.instance_path, exist_ok=True)