Fix (code-review): öffentliche Basis-URL aus X-Forwarded-* bzw. PUBLIC_BASE_URL statt request-origin (localhost hinter Proxy) — korrekte Return-/Webhook-/Erfolgs-URLs für Mollie+Demo

src/pages/api/checkout.js

@@ -8,6 +8,16 @@ export const prerender = false;
 
 function json(obj, status = 200) { return new Response(JSON.stringify(obj), { status, headers: { 'Content-Type': 'application/json' } }); }
 
+function publicBase(request) {
+  const env = (process.env.PUBLIC_BASE_URL || '').trim().replace(/\/$/, '');
+  if (env) return env;
+  const proto = request.headers.get('x-forwarded-proto') || 'https';
+  const host = request.headers.get('x-forwarded-host') || request.headers.get('host');
+  if (host) return `${proto}://${host}`;
+  try { return new URL(request.url).origin; } catch { return ''; }
+}
+
+
 export async function POST({ request }) {
   let body;
   try { body = await request.json(); } catch { return json({ error: 'Bad request' }, 400); }
@@ -83,7 +93,7 @@ export async function POST({ request }) {
     redeemDiscount(discount.id, discount.code, email, order.id, discount.freeShipping ? 0 : discountCents);
   }
 
-  const origin = new URL(request.url).origin;
+  const origin = publicBase(request);
   const returnUrl = `${origin}/bestellung-erfolgreich?order=${order.number}`;
   const pay = await createPayment({
     order, items: lineItems, lineItems, totalCents: total, shippingCents,