Ive been advised that I need to set the RequestHeader X-Forwarded-Proto for a node.js application (NodeBB) to resolve an issue with sessions / csrf tokens.

Here's the relevant excerpt from my apache2 config:

ProxyRequests off

<Proxy *>
    Order allow,deny
    Allow from all

    RewriteEngine On

RewriteCond %{REQUEST_URI}  ^/socket.io            [NC]
RewriteCond %{QUERY_STRING} transport=websocket    [NC]
RewriteRule /(.*)           ws://$1 [P,L]

RequestHeader set X-Forwarded-Proto "http"

ProxyPass /
ProxyPassReverse /

Apache version is 2.4.7

through a debugging proxy I can see the following headers in the response

HTTP/1.1 200 OK
Date: Wed, 03 Aug 2016 06:55:15 GMT
Server: Apache
X-Powered-By: Express
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Origin: null
Content-Type: text/html; charset=utf-8
ETag: W/"3626-ETnKpHnKC8ul87CmR6NFUg"
Vary: Accept-Encoding
Content-Encoding: gzip
set-cookie: express.sid=s%3AYq3UdEAd4Cbwhc4-pMTrqqEp8ftUDeiu.CdipRmQptJlhnUG8ZhCSYgq%2FpCR0Kdmqx3Lrm5ABiSc; Domain=removed.com; Path=/; Expires=Wed, 17 Aug 2016 06:55:15 GMT; HttpOnly
Cache-Control: max-age=0, no-store
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked

I think that is coming from Express js i.e. the node app but my understanding is that the Apache proxy directives should be passing a request header TO express so I'm not sure if I should also see the X-Forwarded-Proto header in the response too.

  • ...I assume the problem is that the request header does not appear to being set? What version of Apache are you using?
    – MrWhite
    Commented Aug 2, 2016 at 10:05
  • i think so but haven't managed to prove that yet
    – codecowboy
    Commented Aug 2, 2016 at 15:03
  • updated question with apache version.
    – codecowboy
    Commented Aug 3, 2016 at 5:13

2 Answers 2


It's correct to set this directive like

RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
RequestHeader set "X-Forwarded-SSL" expr=%{HTTPS}

If it doesn't work, you may need to install and enable the module mod_headers.

  • 2
    A code only answer is not very high quality. Please edit your answer to explain the code. How and why does it answer the question? Link to any relevant documentation. Commented Jun 29, 2017 at 13:06
  • 2
    Just watch which version of Apache 2.4 are you running.. Some very early ones from 2.4.x branch (common in RH7 and Ubuntu) don't support expr yet, so you'll probably need to set constant values. Commented Sep 2, 2018 at 14:54
  • Had to remove the quotation marks from "X-Forwarded-Proto" resp. "X-Forwarded-SSL" to get it to work …
    – tanius
    Commented Dec 31, 2018 at 0:14

Those response headers you are seeing look fine. You should not expect to the X-Forwarded-Proto header in them.

As you state, that header is set when the request is proxied to the back end. To see that header, you would have to have your backend code look for it and log the value.

It appears that you are setting the header correctly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.