diff --git a/lib/app.js b/lib/app.js
index f7cf763..b03baee 100644
--- a/lib/app.js
+++ b/lib/app.js
@@ -256,7 +256,7 @@ module.exports = function(tilelive, options) {
           return next(err);
         }
 
-        var protocol = req.headers['x-forwarded-proto'] || req.protocol;
+        var protocol = req.headers['x-forwarded-proto'] && req.headers['x-forwarded-proto'].match(/^[a-z]+$/) || req.protocol;
         var host = req.headers['x-forwarded-host'] || req.headers.host;
         var uri = protocol + "://" + host +
           (path.dirname(req.originalUrl) +