Support for X-Forwarded-Proto Header to Prevent Mixed Content Issues #1764

New Issue

MrUnknownDE · 2026-04-05T19:41:16+02:00

MrUnknownDE commented

2026-04-05 19:41:16 +02:00

Originally created by @kerbymart on 2/24/2025

I'm encountering mixed content errors when accessing services through Pangolin. This issue arises because Pangolin, acting as a reverse proxy, doesn't currently set the X-Forwarded-Proto header. As a result, backend services are unable to determine the original protocol (HTTP or HTTPS) used by the client, leading to mixed content warnings and blocked resources in browsers.

Proposed Solution:

Implement the addition of the X-Forwarded-Proto header in Pangolin's reverse proxy functionality. This header should reflect the protocol used by the client to connect to Pangolin (http or https). By including this header, backend services can accurately detect the client's protocol and adjust their responses accordingly, thereby preventing mixed content issues.

References:

ONLYOFFICE Documentation: Discusses the importance of the X-Forwarded-Proto header in proxy setups to prevent mixed content errors.
MDN Web Docs: Provides an overview of the X-Forwarded-Proto header and its role in identifying the protocol used by the client.

Implementing this feature would enhance Pangolin's compatibility with various backend services and improve security by preventing mixed content issues.

*Originally created by @kerbymart on 2/24/2025* I'm encountering mixed content errors when accessing services through Pangolin. This issue arises because Pangolin, acting as a reverse proxy, doesn't currently set the `X-Forwarded-Proto` header. As a result, backend services are unable to determine the original protocol (HTTP or HTTPS) used by the client, leading to mixed content warnings and blocked resources in browsers. **Proposed Solution:** Implement the addition of the `X-Forwarded-Proto` header in Pangolin's reverse proxy functionality. This header should reflect the protocol used by the client to connect to Pangolin (`http` or `https`). By including this header, backend services can accurately detect the client's protocol and adjust their responses accordingly, thereby preventing mixed content issues. **References:** - **[ONLYOFFICE Documentation:](https://helpcenter.onlyoffice.com/installation/docs-community-proxy.aspx)** Discusses the importance of the `X-Forwarded-Proto` header in proxy setups to prevent mixed content errors. - **MDN Web Docs:** Provides an overview of the `X-Forwarded-Proto` header and its role in identifying the protocol used by the client. Implementing this feature would enhance Pangolin's compatibility with various backend services and improve security by preventing mixed content issues.

MrUnknownDE closed this issue

2026-04-05 19:41:16 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1764