X-Forwarded-Proto

The header that tells the application which scheme the client used, since the request the proxy makes to it is plain HTTP on 127.0.0.1:3000: proxy_set_header X-Forwarded-Proto $scheme sends https when the browser arrived on 443. HTTPS terminated at nginx is not something the application can observe — its socket is unencrypted and stays that way. Without the header it believes it is in the clear, and three things follow: absolute URLs built as http://, a redirect loop when the framework forces HTTPS while nginx hands the request back, and cookies set without the Secure attribute. The last one is the expensive one, because it does not look like a configuration error. It looks like "my session drops at random". The application still has to opt in — app.set('trust proxy', 1) in Express — or it ignores the header, correctly, since a client can forge this one too.