Preserve the canonical account host across the internal Next.js rewrite by preferring the trusted X-Forwarded-Host value supplied by the dedicated Nginx proxy. This prevents the rewritten /account request from being misclassified as a corporate localhost request and eliminates the account root redirect loop while retaining the public-host isolation rule. Verified Prettier, ESLint, route generation, TypeScript, and the production frontend build.

1 files changed, 3 insertions, 1 deletions

diff --git a/apps/web/proxy.ts b/apps/web/proxy.ts
index 42249a2..06bbc8c 100644
--- a/apps/web/proxy.ts
+++ b/apps/web/proxy.ts
@@ -5,7 +5,9 @@ const accountHosts = new Set(["account.progmasoft.com", "account.localhost"]);
 
 export function proxy(request: NextRequest) {
   const host =
-    request.headers.get("host")?.split(":", 1)[0]?.toLowerCase() ?? "";
+    (request.headers.get("x-forwarded-host") ?? request.headers.get("host"))
+      ?.split(":", 1)[0]
+      ?.toLowerCase() ?? "";
   const pathname = request.nextUrl.pathname;
 
   // The account root has its own landing page, but authentication and dashboard URLs remain stable and readable.