@@ -70,6 +70,7 @@ http {
location @proxy_to_app {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $http_host;
proxy_redirect off;
@@ -132,6 +133,7 @@ http {
location @proxy_to_app {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $http_host;
proxy_redirect off;
@@ -37,6 +37,7 @@ http {
location @proxy_to_app {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $http_host;
proxy_redirect off;
docker/settings.py sets SECURE_PROXY_SSL_HEADER to trust X-Forwarded-Proto, but nginx never sent it, so Django treated every request as plain HTTP even when served over HTTPS: request.is_secure() was false and absolute URLs it built used http://. Set it from $scheme, which also overwrites any value the client sends. This also fixes the 403 on login when the site is served on a non-default HTTPS port such as https://localhost:8081: Django now sees the request as secure, so the browser's Origin matches the request without listing the port in CSRF_TRUSTED_ORIGINS. Fixes [YOCTO #15329] AI-Generated: Claude Opus 5.5 Signed-off-by: Tim Orling <tim.orling@konsulko.com> --- docker/nginx-ssl.conf | 2 ++ docker/nginx.conf | 1 + 2 files changed, 3 insertions(+)