How X-Forwarded-Proto works
When a load balancer handles HTTPS and talks plain HTTP to your app, the app sees every request as HTTP. Apps that redirect HTTP to HTTPS then redirect forever (“too many redirects”), and generated links and secure cookies break. Configure the app to trust this header from your proxy.
Examples
X-Forwarded-Proto: https
X-Forwarded-Host: www.example.comCheck it
# Show the request headers curl sends (lines starting with >)
curl -sv -o /dev/null https://example.com 2>&1 | grep '^>'Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.
Related headers
- X-Forwarded-For: carries the original client IP address through proxies and load balancers.
- Forwarded: the standard form of the X-Forwarded-* headers: client address, protocol and host in one header.
- Strict-Transport-Security: tells browsers to use only HTTPS for this site, for a given time (HSTS).
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What does the X-Forwarded-Proto header do?
The X-Forwarded-Proto request header tells the application whether the client connected over HTTPS or HTTP, when TLS ends at a proxy. When a load balancer handles HTTPS and talks plain HTTP to your app, the app sees every request as HTTP. Apps that redirect HTTP to HTTPS then redirect forever (“too many redirects”), and generated links and secure cookies break. Configure the app to trust this header from your proxy.
How do I see the X-Forwarded-Proto header?
Open your browser’s dev tools, select a request in the Network tab and look under Request Headers. On the command line, "curl -v https://example.com" prints the request headers it sends, marked with ">".