I have a Drupal site running on load-balanced Elastic Beanstalk environment (nginx with PHP FPM) and it was working fine. However, I recently added another layer in front with Cloudfront so I could setup multiple origins. When I did, the X-Forwarded-Proto as seen on the server returns http vs. https, so the Drupal site then generates various URLs using that scheme vs. the intended one.

I have installed a contrib module called trusted_reverse_proxy which adds all of the X-Forwarded-For IP addresses to the reverse_proxy_addresses setting so theoretically, those X-Forwarded-* headers get passed along.

To follow my setup, the CloudFront redirects http to https on the browser end. Then it sends the request with all Headers to the Application Load Balancer on port 80. That sends the request to the elastic beanstalk target group on Port 80. Then on each elastic beanstalk instance, there’s nginx running on port 80 and it sends PHP requests to the PHP FPM process.

I don’t think I can just force HTTPS on the EB instance b/c I need it to also be able to respond to the EB health check on port 80.

I’ve tried the trusted_reverse_proxy module, which doesn’t help.

I tried following this post, which was helpful. They have a header output PHP file that I used to see the results.

<?php
    header( 'Content-Type: text/plain' );
    echo 'Host: ' . $_SERVER['HTTP_HOST'] . "n";
    echo 'Remote Address: ' . $_SERVER['REMOTE_ADDR'] . "n";
    echo 'X-Forwarded-For: ' . $_SERVER['HTTP_X_FORWARDED_FOR'] . "n";
    echo 'X-Forwarded-Proto: ' . $_SERVER['HTTP_X_FORWARDED_PROTO'] . "n";
    echo 'Server Address: ' . $_SERVER['SERVER_ADDR'] . "n";
    echo 'Server Port: ' . $_SERVER['SERVER_PORT'] . "nn";
?>

Host: www.example.com
Remote Address: IP3
X-Forwarded-For: IP1, IP2
X-Forwarded-Proto: http
Server Address: SERVERIP
Server Port: 80

I’ve also tried adding the proxy_set_header answer from SO, adding it locally and restarting the web server and still get the same result.

I’ve also tried adding the X-Forwarded-Proto to the Cloudfront Origin configuration in the Add Header section.