# Does Fly proxy strip X-Forwarded-Proto header from incoming requests?

**URL:** <https://community.fly.io/t/does-fly-proxy-strip-x-forwarded-proto-header-from-incoming-requests/17976>\
**Category:** Questions / Help\
**Tags:** login-only\
**Created:** [February 1, 2024, 7:18am UTC](https://community.fly.io/t/does-fly-proxy-strip-x-forwarded-proto-header-from-incoming-requests/17976 "2024-02-01T07:18:01Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![freeadria](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/freeadria/32/45742_2.png) [@freeadria](https://community.fly.io/u/freeadria)\
**Post date:** [February 1, 2024, 7:18am UTC](https://community.fly.io/t/does-fly-proxy-strip-x-forwarded-proto-header-from-incoming-requests/17976/1 "2024-02-01T07:18:01Z")

</div>

Hi all,

I’m using fly to deploy Django webapps with these browser security settings on.  
SECURE\_HSTS\_SECONDS = 3600  
SECURE\_HSTS\_INCLUDE\_SUBDOMAINS = True

These settings will not work without passing in the X-Forwarded-Proto header in deployment settings:  
SECURE\_PROXY\_SSL\_HEADER = (“HTTP\_X\_FORWARDED\_PROTO”, “https”)

Django docs advise that this is a possibly unsafe setting since end users can spoof the header in a non-secure (http) request unless the webserver is configured to strip the X-Forwarded-Proto header from all incoming requests. Does the Fly proxy do this?

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/fly1/original/3X/6/e/6e8955d00cb218e186ebbe3a6ab06fefdce15290.svg) [@system](https://community.fly.io/u/system)\
**Post date:** [February 8, 2024, 7:18am UTC](https://community.fly.io/t/does-fly-proxy-strip-x-forwarded-proto-header-from-incoming-requests/17976/2 "2024-02-08T07:18:04Z")

</div>

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.