Angular server redirects to incorrect Location when serving the app behind a proxy

[taeold]

Command

serve

Is this a regression?

• Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

No response

Description

When deploying Angular ssr server on services like Cloud Run or Firebase App Hosting where the application is served behind a frontend proxy, the Location header is incorrectly constructed, and redirect fails.

Minimal Reproduction

app.routes.ts

import { Routes } from '@angular/router';

export const routes: Routes = [
  { path: 'blog', loadChildren: () => import('./blog/blog-routing.module').then(m => m.routes) },
  { path: '**', redirectTo: '/blog' },
];

$ ng build && node dist/testme/server/server.mjs
Node Express server listening on http://localhost:4000

This set up works fine in localhost:

$ curl -v localhost:4000
* Host localhost:4000 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
*   Trying [::1]:4000...
* Connected to localhost (::1) port 4000
> GET / HTTP/1.1
> Host: localhost:4000
> User-Agent: curl/8.7.1
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 302 Found
< X-Powered-By: Express
< location: http://localhost:4000/blog
< Date: Mon, 16 Dec 2024 18:13:02 GMT
< Connection: keep-alive
< Keep-Alive: timeout=5
< Content-Length: 0
<
* Connection #0 to host localhost left intact

But when connecting to a server behind a frontend proxy, the Location header is wrong

~ curl -v https://ng-redirect-bug--danielylee-90.us-central1.hosted.app

* Host ng-redirect-bug--danielylee-90.us-central1.hosted.app:443 was resolved.
...
> GET / HTTP/2
> Host: ng-redirect-bug--danielylee-90.us-central1.hosted.app
> User-Agent: curl/8.7.1
> Accept: */*
>
* Request completely sent off
< HTTP/2 302
< alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
< alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
< content-type: text/html
< date: Mon, 16 Dec 2024 18:14:33 GMT
< location: https://ng-redirect-bug--danielylee-90.us-central1.hosted.app:8080/blog
< server: envoy
< x-cloud-trace-context: c08777b57d0762a74338d2597fedc290;o=1
< x-powered-by: Express
< content-length: 0
< server-timing: l2gfet4t7; dur=65
< via: 1.1 google
< cdn-cache-status: miss
<
* Connection #0 to host ng-redirect-bug--danielylee-90.us-central1.hosted.app left intact

Note the header location: https://ng-redirect-bug--danielylee-90.us-central1.hosted.app:8080/blog

Specifically, the port is set to be 8080 which is the port used on the server, but the port used in the frontend proxy is actually at 443.

Exception or Error

Your Environment

$ ng version

     _                      _                 ____ _     ___
    / \   _ __   __ _ _   _| | __ _ _ __     / ___| |   |_ _|
   / △ \ | '_ \ / _` | | | | |/ _` | '__|   | |   | |    | |
  / ___ \| | | | (_| | |_| | | (_| | |      | |___| |___ | |
 /_/   \_\_| |_|\__, |\__,_|_|\__,_|_|       \____|_____|___|
                |___/


Angular CLI: 19.0.1
Node: 18.19.0
Package Manager: npm 10.2.3
OS: darwin arm64

Angular: 19.0.0
... animations, common, compiler, compiler-cli, core, forms
... platform-browser, platform-browser-dynamic, platform-server
... router

Package                         Version
---------------------------------------------------------
@angular-devkit/architect       0.1702.3
@angular-devkit/build-angular   19.0.1
@angular-devkit/core            17.2.3
@angular-devkit/schematics      19.0.1
@angular/cli                    19.0.1
@angular/ssr                    19.0.1
@schematics/angular             19.0.1
rxjs                            7.8.1
typescript                      5.6.3
zone.js                         0.15.0

Anything else relevant?

The relevant code seems to be at

angular-cli/packages/angular/ssr/node/src/request.ts

Line 88 in e4ff5c9

const port = headers['x-forwarded-port'] ?? socket.localPort;

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}