chromedriverproxy: handle comma-separated X-Forwarded-Proto

X-Forwarded-Proto can be a comma-separated list ("https, http") when a request
traverses multiple proxies. clientWSScheme used the raw header value, so it
wouldn't match "https" and fell back to ws:// — silently reintroducing the
TLS-ingress bug this PR fixes. Take the first (client-facing) token before
comparing. Adds a "https, http" case to the regression test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: rgarcia

server/lib/chromedriverproxy/proxy.go

@@ -190,6 +190,13 @@ func handleCreateSession(w http.ResponseWriter, r *http.Request, logger *slog.Lo
 // there's no TLS indication (e.g. the docker plaintext path).
 func clientWSScheme(r *http.Request) string {
 	if proto := r.Header.Get("X-Forwarded-Proto"); proto != "" {
+		// X-Forwarded-Proto may be a comma-separated list when the request
+		// traverses multiple proxies (e.g. "https, http"); the first value is
+		// the original client-facing scheme.
+		if i := strings.IndexByte(proto, ','); i >= 0 {
+			proto = proto[:i]
+		}
+		proto = strings.TrimSpace(proto)
 		if strings.EqualFold(proto, "https") || strings.EqualFold(proto, "wss") {
 			return "wss"
 		}

server/lib/chromedriverproxy/proxy_test.go

@@ -131,31 +131,37 @@ func TestHandler_PostSession_InjectsDebuggerAddress(t *testing.T) {
 // webSocketUrl is wss:// — a ws:// URL would be unreachable through the TLS
 // listener (this is what broke the BiDi tests on the hypeman :9224 ingress).
 func TestHandler_PostSession_WSSchemeFromForwardedProto(t *testing.T) {
-	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(`{"value":{"sessionId":"abc123","capabilities":{"webSocketUrl":"ws://127.0.0.1:9225/session/abc123"}}}`))
-	}))
-	defer backend.Close()
-
-	backendURL, _ := url.Parse(backend.URL)
-	handler := Handler(silentLogger(), testOptions(backendURL.Host, "127.0.0.1:9911"))
-
-	req := httptest.NewRequest(http.MethodPost, "/session", strings.NewReader(`{"capabilities":{}}`))
-	req.Host = "inst.dev-yul-hypeman-1.kernel.sh:9224"
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("X-Forwarded-Proto", "https")
-	rec := httptest.NewRecorder()
+	// "https" plus the multi-proxy comma-separated form ("https, http"), where
+	// only the first (client-facing) value should decide the scheme.
+	for _, proto := range []string{"https", "https, http"} {
+		t.Run(proto, func(t *testing.T) {
+			backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.Header().Set("Content-Type", "application/json")
+				w.WriteHeader(http.StatusOK)
+				w.Write([]byte(`{"value":{"sessionId":"abc123","capabilities":{"webSocketUrl":"ws://127.0.0.1:9225/session/abc123"}}}`))
+			}))
+			defer backend.Close()
+
+			backendURL, _ := url.Parse(backend.URL)
+			handler := Handler(silentLogger(), testOptions(backendURL.Host, "127.0.0.1:9911"))
+
+			req := httptest.NewRequest(http.MethodPost, "/session", strings.NewReader(`{"capabilities":{}}`))
+			req.Host = "inst.dev-yul-hypeman-1.kernel.sh:9224"
+			req.Header.Set("Content-Type", "application/json")
+			req.Header.Set("X-Forwarded-Proto", proto)
+			rec := httptest.NewRecorder()
 
-	handler.ServeHTTP(rec, req)
-	require.Equal(t, http.StatusOK, rec.Code)
+			handler.ServeHTTP(rec, req)
+			require.Equal(t, http.StatusOK, rec.Code)
 
-	var respBody map[string]interface{}
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &respBody))
-	value := respBody["value"].(map[string]interface{})
-	respCaps := value["capabilities"].(map[string]interface{})
-	assert.Equal(t, "wss://inst.dev-yul-hypeman-1.kernel.sh:9224/session/abc123", respCaps["webSocketUrl"],
-		"webSocketUrl must be wss:// when X-Forwarded-Proto is https")
+			var respBody map[string]interface{}
+			require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &respBody))
+			value := respBody["value"].(map[string]interface{})
+			respCaps := value["capabilities"].(map[string]interface{})
+			assert.Equal(t, "wss://inst.dev-yul-hypeman-1.kernel.sh:9224/session/abc123", respCaps["webSocketUrl"],
+				"webSocketUrl must be wss:// when X-Forwarded-Proto's first value is https (got %q)", proto)
+		})
+	}
 }
 
 // TestHandler_RewritesHostAndStripsOrigin is a regression test for the