X-Forward-Proto custom header

Question

I am leveraging AWS ALB & My setup is as follows :

ALB]--HTTPS--[NGINX]--HTTP--[ALB]--HTTP--[APP/NGINX]

the problem is I am using NGINX to forward X-Forwarded-Proto=https to the application through the ALB , but the ALB is stripping it down, the application needs X-Forwarded-Proto=https so that it can issue secure cookies and set STS header. We have tried setting this header in NGINX, but looks like APP ALB strips it down. and per AWS support this is by design.

there is a workaround to use a custom header to save the X-Forwarded-Proto value from the first ALB and send it along to the second ALB and that won't get strip down when it reaches the APP, can anyone advise on how to implement this on NGINX or suggest a different workaround to this problem

Answer 1

From this forum link, they said that Application Load Balancer will pass the X-Forwarded-For/Proto/Port https://forums.aws.amazon.com/thread.jspa?messageID=738145.

If in your case the X-Forwarded-Proto header always getting value HTTP. Then, that's mean AWS ALB is not stripping the X-Forwarded-Proto header, instead, they will replace it. If its true that AWS ALB replace X-Forwarded-Proto, you can use custom HTTP header to pass the header in first nginx instance. Like this one

Location /{
    proxy_pass http://upstream;
    proxy_set_header X-Custom-Forwarded-Proto $http_x_forwarded_proto;
}

Hope this will help. Thanks