Get correct protocol when creating request.

[zimonitrome]

This replaces defaulting to http which is not always correct nor safe.

This feature was removed in an older commit (f69826f#diff-cf234a385fd7788d61976c078d5d093b2de418c259f1f7b3a15adb46ee1cedc3).

This commit re-implements said feature but with the standard of checking the "x-forwarded-proto" header or defaulting to "https". A standard which is already used in start-vercel:

solid-start/packages/start-vercel/entry.js

Line 58 in 925ea73

let protocol = req.headers["x-forwarded-proto"] || "https";

solid-start/packages/start-vercel/entry-prerender.js

Line 57 in 925ea73

let protocol = req.headers["x-forwarded-proto"] || "https";

PR Checklist

Please check if your PR fulfills the following requirements:

• Tests for the changes have been added (for bug fixes / features)

PR Type

What kind of change does this PR introduce?

• Bugfix
• Feature
• Code style update (formatting, local variables)
• Refactoring (no functional changes, no api changes)
• Build related changes
• CI related changes
• Documentation content changes
• infrastructure changes
• Other... Please describe:

What is the current behavior?

The current behavior will incorrectly default some POST requests to use the HTTP protocol when sending information. This will trigger most browsers into warning the user about an unsecure exchange of information.

This will occur when the website headers does not include an origin header.

What is the new behavior?

The new behavior tries to interpret the correct protocol (HTTP/HTTPS) from the "x-forwarded-proto" header which is the de-facto standard header for identifying the protocol.

If an origin header does not exist, the request protocol will still be correctly set to the appropriate protocol.

[zimonitrome]

This fixes issues I've been having for a very long time:
nextauthjs/next-auth#8155
OrJDev/solid-auth#8

[ryansolid]

Thank you