Livewire prefix using wrong scheme

[milliams]

I have installed the latest Git version of Cachet 3 and am seeing "Blocked loading mixed active content" errors in Firefox when trying to log in.

The cause is the URLs that Livewire is generating have the wrong scheme. Once installed at example.com, I do:

curl -s https://example.com/dashboard/login | grep livewire | grep http://

and I get

    <script src="https://example.com//vendor/livewire/livewire.min.js?id=f4724cc4" data-csrf="SgCkvJ6vlmUDtLQVwPYlp9B8K22N99uNpYvPOGkR" data-module-url="http://example.com/livewire-e8bcf38f" data-update-uri="http://example.com/livewire-e8bcf38f/update" data-navigate-once="true"></script>

Note that the src has the https scheme, but data-module-url and data-update-uri have http.

If I manually edit the source in the browser developer tools to be https:// I can log in.

I have tried digging into the code to see where this prefix is coming from but I cannot find it.

I see the error both when running a dev server with php artisan serve as well as running behind Caddy and PHP-FPM. In both cases it's fronted by a Cloudflare tunnel which is doing the TLS termination and everything behind it it is just talking HTTP.

I have set

APP_URL=https://example.com
ASSET_URL=https://example.com

in case that makes any difference.

[jbrooksuk]

Can you try setting this in your .env:

TRUSTED_PROXIES=*

[milliams]

I tried setting both:

CACHET_TRUSTED_PROXIES="*"
TRUSTED_PROXIES="*"

and it made no observable difference.

[jbrooksuk]

Did you run php artisan config:cache after changing the variables?

[milliams]

I hadn't. But I've just tried it after running that command and there's no change.

[jbrooksuk]

Okay, this is definitely a bug. Fixing this now.