What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If every page starts returning HTTP 500 after a site is placed behind a CDN and a second proxy, inspect the forwarding headers reaching the application. In one reported Next.js and Auth.js v5 beta deployment, both proxy hops contributed https to X-Forwarded-Proto. Fetch exposed the repeated values as https, https; Auth.js then used that string to build a session URL, and URL parsing failed. Because the authentication wrapper ran on matched requests, the error affected routes even when they did not otherwise need session data.
How a repeated forwarding value can break URL construction
The failure described by Mahmut Gündüzalp followed a browser-to-CDN-to-origin-web-server-to-Node request path. The CDN set X-Forwarded-Proto: https, and the origin web server also added its own HTTPS value. Depending on proxy behavior, those values appeared as repeated header lines or as a comma-separated value.
As an Amazon Associate I earn from qualifying purchases.
In the reported build, the Fetch Headers object exposed repeated values as one comma-separated string. With no AUTH_URL configured, the Auth.js v5 beta path described in the case read x-forwarded-host and x-forwarded-proto, then used the scheme to construct an absolute URL. A single https produced an ordinary HTTPS URL; https, https did not. The attempted URL was effectively https, https://example.org, and new URL(...) threw TypeError: Invalid URL. The case author says these outcomes were re-measured against the deployed library build. Read the case study by Mahmut Gündüzalp.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The important point is not that every pair of proxies causes this exception. It is that middleware or a library may treat a multi-value forwarding header as one scheme or host, even though multiple hops can contribute values. The result depends on the proxy chain, header handling, and exact deployed library version.
#1 Best Overall
Why the error reached routes that did not need a session
The application used the Auth.js auth() middleware wrapper to resolve a session for matched requests. In the reported configuration, URL construction happened inside that wrapper before the site’s own middleware logic. A thrown parsing error therefore interrupted requests to matched paths whether or not the eventual route itself needed session information.
The author reports that the local development machine did not reproduce the issue because it lacked the deployed proxy chain. That contrast is a useful clue: compare the request as it arrives at the application in production with the request reaching the app locally, rather than assuming the route code is responsible.
Rank #2
- Used Book in Good Condition
Trace the request from the application outward
- Capture the values at the application boundary. Log the received
X-Forwarded-ProtoandX-Forwarded-Host, including whether the server exposes repeated lines as a comma-joined value. Protect sensitive host and request data in logs. - Map each proxy hop. Record which component sets, appends, preserves, or overwrites forwarding metadata. RFC 7239 permits successive proxies to add values using another field or a comma-separated value. RFC 7239: Forwarded HTTP Extension.
- Find where the application builds absolute URLs. Check authentication middleware, redirects, callbacks, and other code that assumes the forwarded scheme or host is a single value. Verify behavior against the version actually deployed.
- Check the trusted-proxy boundary. Determine whether the edge proxy overwrites client-supplied forwarding values or preserves them, and which upstream hops the application is configured to trust.
- Trace what happens after origin configuration changes. If an explicit public origin is introduced, inspect later redirects and rewrites that derive their target from the request URL.
- Correlate the application exception with proxy logs. Identify which component emitted the status before treating the status code as a diagnosis.
Why blindly taking the first or last value is unsafe
Do not treat “use the first value” or “use the last value” as a universal repair. Which entry is meaningful depends on which proxy is trusted, what each hop records, whether a client-provided value was overwritten, and the framework’s intended origin semantics. RFC 7239 warns that forwarded information can be altered by nodes along the path, including the client. Trust should come from a deliberately configured proxy boundary, not from the header’s name alone.
The RFC describes the standardized Forwarded header; the case concerns the commonly used X-Forwarded-* fields. Their exact parsing and proxy behavior can vary by implementation. Confirm the conventions used by the actual CDN, origin server, framework, and deployed library rather than assuming that all headers or proxy chains behave alike.
What the AUTH_URL workaround fixed—and what it broke
In the case report, setting AUTH_URL=https://example.org avoided the malformed session URL. It also caused the wrapper to rebuild the request using the public origin. A later i18n middleware generated a rewrite from req.url; with the public address in that URL, the rewrite went back through the CDN and looped.
This was a secondary failure in that deployment, not proof that an explicit origin always causes rewrite loops. Before adopting an explicit origin, follow the request through every downstream middleware that creates absolute redirects or rewrites. Establish whether those components need the internal origin, the public origin, or a path-only target.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Distinguish an application 500 from a proxy 502
HTTP 500 means the server encountered an unexpected condition; it does not identify which line of code or component failed. HTTP 502 means a gateway or proxy received an invalid response from an upstream server. Either status needs logs and request-path evidence to locate the cause. The definitions appear in the legacy HTTP/1.1 specification, RFC 2616; the code alone is not a diagnosis. RFC 2616: Hypertext Transfer Protocol — HTTP/1.1.
Recommended Free Tools
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
