Change your server quantity, update payment methods, or view
- invoices.
+ {{-- Billing --}}
+
+
+ Manage Billing on Stripe
+
+
+ {{-- Resume or Cancel --}}
+ @if (currentTeam()->subscription->stripe_cancel_at_period_end)
+
Resume Subscription
+ @else
+
+
+ @endif
+
+ {{-- Refund --}}
+ @if ($refundCheckLoading)
+
+ @elseif ($isRefundEligible && !currentTeam()->subscription->stripe_cancel_at_period_end)
+
+ @endif
+
+ {{-- Contextual notes --}}
+ @if ($isRefundEligible && !currentTeam()->subscription->stripe_cancel_at_period_end)
+
Refund already processed. Each team is eligible for one refund only.
+ @endif
+ @if (currentTeam()->subscription->stripe_cancel_at_period_end)
+
Your subscription is set to cancel at the end of the billing period.
+ @endif
- {{-- Refund Section --}}
- @if ($refundCheckLoading)
-
- @elseif ($isRefundEligible && !currentTeam()->subscription->stripe_cancel_at_period_end)
-
- @endif
-
- {{-- Resume / Cancel Subscription Section --}}
- @if (currentTeam()->subscription->stripe_cancel_at_period_end)
-
Need help?
Contact us.
diff --git a/tests/Feature/SecureCookieAutoDetectionTest.php b/tests/Feature/SecureCookieAutoDetectionTest.php
new file mode 100644
index 000000000..4db0a7681
--- /dev/null
+++ b/tests/Feature/SecureCookieAutoDetectionTest.php
@@ -0,0 +1,64 @@
+ 0], ['fqdn' => null]);
+ // Ensure session.secure starts unconfigured for each test
+ config(['session.secure' => null]);
+});
+
+it('sets session.secure to true when request arrives over HTTPS via proxy', function () {
+ $this->get('/login', [
+ 'X-Forwarded-Proto' => 'https',
+ 'X-Forwarded-For' => '1.2.3.4',
+ ]);
+
+ expect(config('session.secure'))->toBeTrue();
+});
+
+it('does not set session.secure for plain HTTP requests', function () {
+ $this->get('/login');
+
+ expect(config('session.secure'))->toBeNull();
+});
+
+it('does not override explicit SESSION_SECURE_COOKIE=false for HTTPS requests', function () {
+ config(['session.secure' => false]);
+
+ $this->get('/login', [
+ 'X-Forwarded-Proto' => 'https',
+ 'X-Forwarded-For' => '1.2.3.4',
+ ]);
+
+ // Explicit false must not be overridden — our check is `=== null` only
+ expect(config('session.secure'))->toBeFalse();
+});
+
+it('does not override explicit SESSION_SECURE_COOKIE=true', function () {
+ config(['session.secure' => true]);
+
+ $this->get('/login');
+
+ expect(config('session.secure'))->toBeTrue();
+});
+
+it('marks session cookie with Secure flag when accessed over HTTPS proxy', function () {
+ $response = $this->get('/login', [
+ 'X-Forwarded-Proto' => 'https',
+ 'X-Forwarded-For' => '1.2.3.4',
+ ]);
+
+ $response->assertSuccessful();
+
+ $cookieName = config('session.cookie');
+ $sessionCookie = collect($response->headers->all('set-cookie'))
+ ->first(fn ($c) => str_contains($c, $cookieName));
+
+ expect($sessionCookie)->not->toBeNull()
+ ->and(strtolower($sessionCookie))->toContain('; secure');
+});
diff --git a/tests/Feature/TrustHostsMiddlewareTest.php b/tests/Feature/TrustHostsMiddlewareTest.php
index b745259fe..5c60b30d6 100644
--- a/tests/Feature/TrustHostsMiddlewareTest.php
+++ b/tests/Feature/TrustHostsMiddlewareTest.php
@@ -286,6 +286,56 @@
expect($response->status())->not->toBe(400);
});
+it('trusts localhost when FQDN is configured', function () {
+ InstanceSettings::updateOrCreate(
+ ['id' => 0],
+ ['fqdn' => 'https://coolify.example.com']
+ );
+
+ $middleware = new TrustHosts($this->app);
+ $hosts = $middleware->hosts();
+
+ expect($hosts)->toContain('localhost');
+});
+
+it('trusts 127.0.0.1 when FQDN is configured', function () {
+ InstanceSettings::updateOrCreate(
+ ['id' => 0],
+ ['fqdn' => 'https://coolify.example.com']
+ );
+
+ $middleware = new TrustHosts($this->app);
+ $hosts = $middleware->hosts();
+
+ expect($hosts)->toContain('127.0.0.1');
+});
+
+it('trusts IPv6 loopback when FQDN is configured', function () {
+ InstanceSettings::updateOrCreate(
+ ['id' => 0],
+ ['fqdn' => 'https://coolify.example.com']
+ );
+
+ $middleware = new TrustHosts($this->app);
+ $hosts = $middleware->hosts();
+
+ expect($hosts)->toContain('[::1]');
+});
+
+it('allows local access via localhost when FQDN is configured and request uses localhost host header', function () {
+ InstanceSettings::updateOrCreate(
+ ['id' => 0],
+ ['fqdn' => 'https://coolify.example.com']
+ );
+
+ $response = $this->get('/', [
+ 'Host' => 'localhost',
+ ]);
+
+ // Should NOT be rejected as untrusted host (would be 400)
+ expect($response->status())->not->toBe(400);
+});
+
it('skips host validation for webhook endpoints', function () {
// All webhook routes are under /webhooks/* prefix (see RouteServiceProvider)
// and use cryptographic signature validation instead of host validation