# DiscourseConnect generates HTTP redirects even with force\_https on

**URL:** <https://meta.discourse.org/t/discourseconnect-generates-http-redirects-even-with-force-https-on/309338>\
**Category:** Self-hosting\
**Tags:** discourseconnect\
**Created:** [May 24, 2024, 8:52pm UTC](https://meta.discourse.org/t/discourseconnect-generates-http-redirects-even-with-force-https-on/309338 "2024-05-24T20:52:28Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![supermathie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/supermathie/32/507518_2.png) [@supermathie](https://meta.discourse.org/u/supermathie)\
**Post date:** [May 27, 2024, 4:33pm UTC](https://meta.discourse.org/t/discourseconnect-generates-http-redirects-even-with-force-https-on/309338/5 "2024-05-27T16:33:10Z")

</div>

> [@matiasgarciaisaia](#):
>
> tell my Traefik to add an `X-Forwarded-Proto: https` header

This is how we do it on our hosting platform; we have a load balancer layer that sets `X-Forwarded-Proto` for the downstream nginx+Discourse to consume.

We don’t need any additional shenanigans to make it work - I’m not sure what’s going wrong for you here.

> [@matiasgarciaisaia](#):
>
> Once again, I think if there’s a `force_https` setting, Discourse-the-rails-app should honor it, regardless of what the reverse proxy or other parties handle or not.

This is indeed what happens:

```plaintext
  def self.generate_sso(return_path = "/", secure_session:)
    sso = new(secure_session: secure_session)
    sso.nonce = SecureRandom.hex
    sso.register_nonce(return_path)
    sso.return_sso_url = Discourse.base_url + "/session/sso_login"
    sso
  end

```

and `base_url` comes from:

```plaintext
  def self.base_protocol
    SiteSetting.force_https? ? "https" : "http"
  end

  def self.base_url_no_prefix
    "#{base_protocol}://#{current_hostname_with_port}"
  end

  def self.base_url
    base_url_no_prefix + base_path
  end

```

---

_[View the full topic](https://meta.discourse.org/t/discourseconnect-generates-http-redirects-even-with-force-https-on/309338)._