Replace custom reverse proxy middleware with werkzeug ProxyFix

The custom middleware duplicated the Host header behind multi-layer
proxies, which werkzeug 3.1.7+ rejects with a 400 error.

Fixes #366

JIRA: RHELWF-14040

Assisted-by: Claude Code (claude-opus-4-6)

Author: Lukas Holecek

resultsdb/__init__.py

@@ -34,14 +34,14 @@
 )
 from flask_pyoidc.user_session import UserSession
 from flask_session import Session
+from werkzeug.middleware.proxy_fix import ProxyFix
 
 from resultsdb.controllers.api_v2 import api as api_v2
 from resultsdb.controllers.api_v3 import api as api_v3
 from resultsdb.controllers.api_v3 import create_endpoints
 from resultsdb.controllers.main import main
 from resultsdb.messaging import load_messaging_plugin
 from resultsdb.models import db
-from resultsdb.proxy import ReverseProxied
 from resultsdb.tracing import setup_tracing
 
 from . import config
@@ -56,8 +56,7 @@ def create_app(config_obj=None):
     app = Flask(__name__)
     app.secret_key = "replace-me-with-something-random"  # nosec # NOSONAR
 
-    # make sure app behaves when behind a proxy
-    app.wsgi_app = ReverseProxied(app.wsgi_app)
+    app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1, x_host=1, x_prefix=1)
 
     # Expose the __version__ variable in templates
     app.jinja_env.globals["app_version"] = __version__

resultsdb/proxy.py

@@ -1,10 +1,27 @@
 from unittest.mock import Mock
 
 from pytest import raises
+from werkzeug.test import EnvironBuilder
 
 from resultsdb import setup_messaging
 
 
+def test_proxy_fix_extracts_single_host(app):
+    """Regression test for https://github.com/release-engineering/resultsdb/issues/366"""
+    builder = EnvironBuilder(method="GET", path="/api/v2.0/")
+    env = builder.get_environ()
+    env["HTTP_X_FORWARDED_HOST"] = "resultsdb.example.com, resultsdb.example.com"
+
+    responses = []
+    app.wsgi_app(env, lambda status, headers: responses.append(status))
+
+    assert responses
+    assert not responses[0].startswith("400"), (
+        f"Duplicate X-Forwarded-Host should not cause 400, got: {responses[0]}"
+    )
+    assert env["HTTP_HOST"] == "resultsdb.example.com"
+
+
 def test_app_messaging(app):
     assert app.messaging_plugin is not None
     assert type(app.messaging_plugin).__name__ == "DummyPlugin"