💡Add X-Forwarded-Proto header when incoming HTTPS request is forwarded to an HTTP service

[davidbarratt]

Describe the feature you'd like
Currently, I have a several sites that are on a single host that are only accessible through the Cloudflare Tunnel. Once the request reaches the host, it is completely fine for the TLS to be terminated. However, if I forward the request to http://localhost then the application believes it was received on HTTP (despite the incoming request being HTTPS).

Describe alternatives you've considered

1. Create a valid certificate for each hostname
2. Create a self-signed certificate for each hostname and instruct cloudflared to ignore TLS verification
3. Modify each application to assume https rather than http
4. Add an X-Forwarded-Proto to the Request Header rules in Cloudflare (which seems unsafe)

Additional context
I feel like in previous versions this was the case, but at some point maybe it changed?

I really want to be able to have a service at http but the request indicates that it was received on https

[davidbarratt]

Nevermind, it seems to be there, I'm not sure what's wrong with my application then.

I figured this out by adding a compose.yml file with this:

services:
  cloudflared:
    image: cloudflare/cloudflared:2024.4.1
    environment:
      TUNNEL_URL: http://echo:8080
    command:
      - tunnel
      - run
      - 778506df-c545-4a45-8c6c-e4f334dfcbcf
    volumes:
      - /home/david/.cloudflared/cert.pem:/etc/cloudflared/cert.pem
      - /home/david/.cloudflared/778506df-c545-4a45-8c6c-e4f334dfcbcf.json:/etc/cloudflared/778506df-c545-4a45-8c6c-e4f334dfcbcf.json
  echo:
    image: mendhak/http-https-echo:33

That revealed the header:

"x-forwarded-proto": "https"

[davidbarratt]

For anyone looking on how to fix this, it was editing this configuration variable which prevents nginx ingress (k8s) from overriding the value:
https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#use-forwarded-headers