Set Host/X-Forwarded-Host so APIService resolves correct org

Shipped

April 18, 2026 at 7:41 PM UTC

Author

Kamo

Commit

f2e9240

APIService overwrites X-Forwarded-Host with request.getServerName(), which reads from the Host header. Without an explicit Host header the K8s internal service hostname was forwarded to SecurityService, causing org lookup to return nothing. Mirror the login proxy pattern: replace login. prefix with api. on both headers.