changes to X-Forwarded-Proto between v1.7 and v1.8

Author: marco-mCreated Sep 14, 2026Updated Sep 16, 2026

Labelsbugquestion

We deploy Fabio behind an AWS ELB. The ELB does TLS termination:

   Internet     |   VPC
                |
        HTTPS   |  HTTP        HTTP
browser =====> ELB ----> Fabio ---> service

The ELB sets correctly, from its point of view, header field X-Forwarded-Proto to https.

Fabio v1.7 (and before) was, I think, just copying the value it found of X-Forwarded-Proto, so in this case https. From my understanding this was a security vulnerability.

Fabio v.1.8 is instead setting X-Forwarded-Proto to what it is actually seeing, so in the deployment above, it is setting it "back" to http.

In the changes from v1.7 to v1.8, I saw that function newHTTPProxy() now returns an httputil.ReverseProxy with the safer Rewrite as opposed to the unsafe Director: https://github.com/fabiolb/fabio/blob/2aad4553c7f96011ee39db91896a691ee745cb84/proxy/http_handler.go#L17

I still have to do more tests, but I think that this explains the changes in the handling of X-Forwarded-Proto.

As far as I understand, the behavior of Fabio v1.8.x is the correct one.

And now to my question:

There are many HTTP services that require X-Forwarded-Proto to be https in order to function. This is how actually we discovered the change I am describing: from an error from one of our services.

What I think I would like to be able to do is the following: somehow tell Fabio: yes, you are forwarding an HTTP (and not HTTPS) connection, BUT you are deployed behind a TLS terminating LB, you can trust the X-Forwarded-XXX header fields that you see.

Example: oauth2_proxy has a setting --reverse-proxy to tell it: you are in a chain you can trust. Doc says:

When --reverse-proxy is enabled, configure --trusted-proxy-ip to the IPs or CIDR ranges of the reverse proxies that are allowed to send X-Forwarded-* headers. If you leave it unset, OAuth2 Proxy currently trusts all source IPs for backwards compatibility, which means a client that can reach OAuth2 Proxy directly may be able to spoof forwarded headers.

https://oauth2-proxy.github.io/oauth2-proxy/configuration/overview?_highlight=reverse_proxy#proxy-options

What do you think ?

I also wonder if somehow one could detect implicitly by the usage of PROXY protocol that Fabio is behind a trusted LB. In Fabio v1.8 went in also the PR that adds support to PROXY protocol v2. I wonder if that had some impact. I plan to test that also.