Bug: Forcing Global Secure Requests does not work when the baseURL has more than a scheme and an authority

[ms1495]

PHP Version

8.2

CodeIgniter4 Version

4.4.3

CodeIgniter4 Installation Method

Composer (using codeigniter4/appstarter)

Which operating systems have you tested for this bug?

Windows

Which server did you use?

apache

Database

MariaDB 11.1

What happened?

When setting in App.php

public bool $forceGlobalSecureRequests = true;

URLs are not rewritten correctly when baseURL has more than a scheme and an authority. For instance, with

public string $baseURL = 'https://glossary.local/glossary/';

requests like: http://glossary.local/glossary/en/acronym
are automatically redirected to: https://glossary.local/glossary/glossary/en/acronym

Steps to Reproduce

1 in App.php, set: public bool $forceGlobalSecureRequests = true;
2 Have a project which appear in your web site mainly in a sub directory
3 Have a baseURL having more than a scheme and an authority like public string $baseURL = 'https://glossary.local/glossary/';
4 Do a request in your browser like: http://glossary.local/glossary/en/acronym

Expected Output

Being redirected to https://glossary.local/glossary/en/acronym

Anything else?

There are examples of similar baseURL in the documentation (and in discussions about bug fixed when getting relative paths)

In fact the redirection URL s generated by force_https, which contains

   $baseURL = config(App::class)->baseURL;

    if (strpos($baseURL, 'https://') === 0) {
        $authority = substr($baseURL, strlen('https://'));
    } elseif (strpos($baseURL, 'http://') === 0) {
        $authority = substr($baseURL, strlen('http://'));
    } else {
        $authority = $baseURL;
    }

    $uri = URI::createURIString(
        'https',
        $authority,
        $request->getUri()->getPath(), // Absolute URIs should use a "/" for an empty path
        $request->getUri()->getQuery(),
        $request->getUri()->getFragment()
    );

Should includeSubDomains not also considered for a better HSTS coverage ? (for preload it could be too late at this point)

[kenjis]

Try #8191