'ERR_TOO_MANY_REDIRECTS' / redirect loop after putting an app behind a reverse proxy or load balancer that terminates HTTPS (X-Forwarded-Proto): how do I fix it?

Cause: the proxy accepts HTTPS from the browser but talks plain HTTP to your app. The app, with a force-HTTPS redirect enabled, sees an http request, redirects to https, the proxy forwards it as http again, and the browser loops until it shows ERR_TOO_MANY_REDIRECTS. The app needs to know the original scheme, which proxies pass in X-Forwarded-Proto (a widely used de facto header; the standard equivalent is Forwarded). Fix: 1. Make the proxy send the header. In nginx: proxy_set_header X-Forwarded-Proto $scheme; (cloud load balancers normally add it automatically). Remember nginx replaces the Host header with the proxy_pass host unless you set proxy_set_header Host $host;. 2. Tell the framework to trust it, only from your proxy: - Express: app.set('trust proxy', <your proxy hops or addresses>) so req.protocol and req.secure reflect the header. Avoid blindly using true unless the last proxy overwrites the forwarded headers. - Django: SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https'). Set it only if the proxy always overwrites that header, otherwise clients can fake HTTPS. - Other frameworks have equivalent settings (trusted proxies / forwarded headers). 3. Make sure the proxy strips any X-Forwarded-Proto sent by clients, and that only the proxy can reach the app port. 4. Also check for a second redirect source (CDN setting such as flexible SSL, plus an app redirect), and clear cached 301s in the browser when testing. Verify: curl -I -L https://your-host/ follows at most one redirect and ends with a 200, and the app generates https URLs and secure cookies. Sources: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Forwarded-Proto https://expressjs.com/en/guide/behind-proxies.html https://docs.djangoproject.com/en/stable/ref/settings/#secure-proxy-ssl-header https://nginx.org/en/docs/http/ngx_http_proxy_module.html