scope["scheme"] is set to comma-separated list when such a value is present in the X-Forwarded-Proto header

[vanschelven]

The X-Forwarded-Proto header is underspecified, but may contain comma-separated values in the wild, see e.g. the CloudFoundry gorouter

If this is the case, the scope["scheme"] will contain such comma-separated values. I think this is probably not what we want, as downstream users expect a single value here.

This is where the copying from the header takes place:

uvicorn/uvicorn/middleware/proxy_headers.py

Line 70 in e2a3979

scope["scheme"] = x_forwarded_proto

Compare how Django does this:

https://github.com/django/django/blob/main/django/http/request.py#L264

This seems to be a rather recent addition, the Django ticket contains more info about other projects with similar fixes.
https://code.djangoproject.com/ticket/33569

[vanschelven]

example of downstream problem which is caused by this: getsentry/sentry-python#2370

[Kludex]

• No action needed, as per my comment on: Add support for multiple values for the x-forwarded-proto header #2104 (comment)