Fix Location header to respect X-Forwarded-Proto and X-Forwarded-Host headers

src/Core/Resolvers/SqlMutationEngine.cs

@@ -397,9 +397,12 @@ await queryExecutor.ExecuteQueryAsync(
                 case EntityActionOperation.Insert:
 
                     HttpContext httpContext = GetHttpContext();
+                    // Use scheme/host from X-Forwarded-* headers if present, else fallback to request values
+                    string scheme = SqlPaginationUtil.ResolveRequestScheme(httpContext.Request);
+                    string host = SqlPaginationUtil.ResolveRequestHost(httpContext.Request);
                     string locationHeaderURL = UriHelper.BuildAbsolute(
-                            scheme: httpContext.Request.Scheme,
-                            host: httpContext.Request.Host,
+                            scheme: scheme,
+                            host: new HostString(host),
                             pathBase: GetBaseRouteFromConfig(_runtimeConfigProvider.GetConfig()),
                             path: httpContext.Request.Path);
 

src/Core/Resolvers/SqlPaginationUtil.cs

@@ -756,7 +756,7 @@ public static string FormatQueryString(NameValueCollection? queryStringParameter
         /// <param name="req">The HTTP request.</param>
         /// <returns>The scheme string ("http" or "https").</returns>
         /// <exception cref="DataApiBuilderException">Thrown when client explicitly sets an invalid scheme.</exception>
-        private static string ResolveRequestScheme(HttpRequest req)
+        internal static string ResolveRequestScheme(HttpRequest req)
         {
             string? rawScheme = req.Headers["X-Forwarded-Proto"].FirstOrDefault();
             string? normalized = rawScheme?.Trim().ToLowerInvariant();
@@ -780,7 +780,7 @@ private static string ResolveRequestScheme(HttpRequest req)
         /// <param name="req">The HTTP request.</param>
         /// <returns>The host string.</returns>
         /// <exception cref="DataApiBuilderException">Thrown when client explicitly sets an invalid host.</exception>
-        private static string ResolveRequestHost(HttpRequest req)
+        internal static string ResolveRequestHost(HttpRequest req)
         {
             string? rawHost = req.Headers["X-Forwarded-Host"].FirstOrDefault();
             string? trimmed = rawHost?.Trim();
@@ -803,7 +803,7 @@ private static string ResolveRequestHost(HttpRequest req)
         /// </summary>
         /// <param name="scheme">Scheme, e.g., "http" or "https".</param>
         /// <returns>True if valid, otherwise false.</returns>
-        private static bool IsValidScheme(string? scheme)
+        internal static bool IsValidScheme(string? scheme)
         {
             return scheme is "http" or "https";
         }
@@ -813,7 +813,7 @@ private static bool IsValidScheme(string? scheme)
         /// </summary>
         /// <param name="host">The host name (with optional port).</param>
         /// <returns>True if valid, otherwise false.</returns>
-        private static bool IsValidHost(string? host)
+        internal static bool IsValidHost(string? host)
         {
             if (string.IsNullOrWhiteSpace(host))
             {

src/Core/Resolvers/SqlResponseHelpers.cs

@@ -381,9 +381,12 @@ HttpContext httpContext
             // The third part is the computed primary key route.
             if (operationType is EntityActionOperation.Insert && !string.IsNullOrEmpty(primaryKeyRoute))
             {
+                // Use scheme/host from X-Forwarded-* headers if present, else fallback to request values
+                string scheme = SqlPaginationUtil.ResolveRequestScheme(httpContext.Request);
+                string host = SqlPaginationUtil.ResolveRequestHost(httpContext.Request);
                 locationHeaderURL = UriHelper.BuildAbsolute(
-                                        scheme: httpContext.Request.Scheme,
-                                        host: httpContext.Request.Host,
+                                        scheme: scheme,
+                                        host: new HostString(host),
                                         pathBase: baseRoute,
                                         path: httpContext.Request.Path);