Zipstack
diff --git a/‎src/unstract/clone/client.py‎
Lines changed: 19 additions & 10 deletions b/‎src/unstract/clone/client.py‎
Lines changed: 19 additions & 10 deletions
diff --git a/‎tests/clone/test_client.py‎
Lines changed: 26 additions & 2 deletions b/‎tests/clone/test_client.py‎
Lines changed: 26 additions & 2 deletions
@@ -128,27 +128,28 @@ def _origin(url: str) -> tuple[str, str, int | None]:
         port = parsed.port or {"http": 80, "https": 443}.get(scheme)
         return (scheme, host, port)
 
-    def _assert_same_origin(self, url: str, label: str) -> None:
-        """Reject a pagination ``next`` link that leaves the platform origin.
+    def _assert_same_host(self, url: str, label: str) -> None:
+        """Reject a pagination ``next`` link that points at a different host.
 
         DRF builds ``next`` from the request host, but a compromised or
         misconfigured response must not redirect the bearer key elsewhere.
-        Compared on normalised origin so equivalent hosts (case, default port)
-        aren't rejected as off-site.
+        Only the host is compared: a TLS-terminating proxy legitimately emits
+        ``http://`` next links (or a non-default port) for an ``https://``
+        client, and rejecting those would break paginated lists on a backend
+        misconfiguration the client can neither see nor fix. The host is the
+        security boundary the bearer key is scoped to.
         """
         try:
-            link_origin = self._origin(url)
+            link_host = self._origin(url)[1]
         except ValueError as e:
             # urlparse raises on a non-numeric / out-of-range port only when
             # ``.port`` is read, so a malformed ``next`` surfaces here.
             raise PlatformAPIError(
                 f"GET {label} pagination 'next' is a malformed URL: {e}"
             ) from e
-        if link_origin != self._origin(self.endpoint.base_url):
-            scheme, host, _ = link_origin
+        if link_host != self._origin(self.endpoint.base_url)[1]:
             raise PlatformAPIError(
-                f"GET {label} pagination 'next' left the platform origin: "
-                f"{scheme}://{host}"
+                f"GET {label} pagination 'next' left the platform host: {link_host}"
             )
 
     @staticmethod
@@ -173,6 +174,10 @@ def _paginate(
         page is worse than one that fails.
         """
         result = self._request("GET", path, params=dict(params or {}))
+        # A 204 / empty body means "no rows", matching the pre-pagination
+        # ``(result or {}).get("results", [])`` guard the call sites relied on.
+        if result is None:
+            return []
         if isinstance(result, list):
             return result
 
@@ -187,8 +192,12 @@ def _paginate(
             if next_url in seen:
                 raise PlatformAPIError(f"GET {path} pagination looped at {next_url}")
             seen.add(next_url)
-            self._assert_same_origin(next_url, path)
+            self._assert_same_host(next_url, path)
             result = self._send("GET", next_url, path)
+            # A ``next`` link that yields an empty body ends pagination; the
+            # count guard below still flags it as a short read.
+            if result is None:
+                break
 
         if expected is not None and len(rows) != expected:
             raise PlatformAPIError(
 
@@ -204,12 +204,12 @@ def test_paginate_rejects_offsite_next():
     # A ``next`` pointing at another host must not receive the bearer key.
     page1 = {"count": 3, "next": "https://evil.example.com/next", "results": [1, 2]}
     client, _ = _client_with_pages(page1)
-    with pytest.raises(PlatformAPIError, match="left the platform origin"):
+    with pytest.raises(PlatformAPIError, match="left the platform host"):
         client.list_tags()
 
 
 def test_paginate_follows_equivalent_origin_next():
-    # Same origin with uppercase host + explicit default port must be followed,
+    # Same host with uppercase + explicit default port must be followed,
     # not rejected as off-site.
     page1 = {
         "count": 3,
@@ -221,6 +221,30 @@ def test_paginate_follows_equivalent_origin_next():
     assert client.list_tags() == [1, 2, 3]
 
 
+def test_paginate_follows_next_with_different_scheme_or_port():
+    # A TLS-terminating proxy emits an http:// (and/or off-port) next link for
+    # an https:// client. Same host → must be followed, not rejected.
+    page1 = {
+        "count": 3,
+        "next": "http://api.example.com:8080/next?page=2",
+        "results": [1, 2],
+    }
+    page2 = {"count": 3, "next": None, "results": [3]}
+    client, _ = _client_with_pages(page1, page2)
+    assert client.list_tags() == [1, 2, 3]
+
+
+def test_paginate_empty_body_returns_empty_list():
+    # A 204 / empty first page means "no rows", not a malformed payload — it
+    # must return [] like the pre-pagination ``(result or {}).get`` guard did.
+    client = PlatformClient(_endpoint())
+    empty = MagicMock()
+    empty.status_code = 204
+    empty.content = b""
+    client._session.request = MagicMock(return_value=empty)
+    assert client.list_tags() == []
+
+
 def test_paginate_raises_on_malformed_port_in_next():
     # A `next` URL with a non-numeric port makes urlparse raise ValueError on
     # `.port`; it must surface as PlatformAPIError, not an incidental traceback.