# Issues with force https, proxy and invitations
**URL:** https://meta.discourse.org/t/issues-with-force-https-proxy-and-invitations/153995
**Category:** Support
**Created:** [June 5, 2020, 10:16pm UTC](https://meta.discourse.org/t/issues-with-force-https-proxy-and-invitations/153995 "2020-06-05T22:16:45Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Felip](https://meta.discourse.org/u/Felip)
#### Post date: [June 5, 2020, 10:16pm UTC](https://meta.discourse.org/t/issues-with-force-https-proxy-and-invitations/153995/1 "2020-06-05T22:16:45Z")
My Discourse instance is behind a proxy:
```plaintext
server {
server_name forum.[...];
location / {
proxy_pass http://IP_ADDRESS;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_redirect off;
}
client_max_body_size 10m;
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/forum.[...]/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/forum.[...]/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
if ($host = forum.[...]) {
return 301 https://$host$request_uri;
} # managed by Certbot
server_name forum.smbcn.org;
listen 80;
return 404; # managed by Certbot
}
```
Which leads to the server Discourse is installed on (standard Docker installation):
```plaintext
server {
listen 80; listen [::]:80;
server_name forum.[...];
client_max_body_size 10m;
location / {
proxy_pass http://unix:/var/discourse/shared/standalone/nginx.http.sock:;
proxy_set_header Host $http_host;
proxy_http_version 1.1;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
}
}
```
When I force HTTPS, invited users cannot proceed to registration. Browser logs show a 403 error (bad CSRF), even though a CSRF token was successfully generated. Invitations work just fine when HTTPS is not forced.
I guess something is wrong with the way I proxy HTTPS requests to HTTP, maybe some missing headers?
---
### Author:  [@Felip](https://meta.discourse.org/u/Felip)
#### Post date: [July 11, 2020, 2:22pm UTC](https://meta.discourse.org/t/issues-with-force-https-proxy-and-invitations/153995/2 "2020-07-11T14:22:28Z")
It looks like I’m really missing something. Being unable to force HTTPS implies that the logo cannot be displayed (not so serious for the time being). I’ve just discovered today I also get a CSRF-related error (“forbidden”) when I try to remove a task in Sidekiq. This is what I found in /var/discourse/shared/standalone/log/rails/unicorn.stderr.log:
> WARN – : attack prevented by Rack::Protection::HttpOrigin
I feel quite helpless, any help would be greatly appreciated.
---
### Author:  [@hawm](https://meta.discourse.org/u/hawm)
#### Post date: [July 11, 2020, 4:06pm UTC](https://meta.discourse.org/t/issues-with-force-https-proxy-and-invitations/153995/3 "2020-07-11T16:06:32Z")
Maybe you just need to the froce https enable on your front proxy, and disable on discourse.
---
### Author:  [@Felip](https://meta.discourse.org/u/Felip)
#### Post date: [July 12, 2020, 7:56am UTC](https://meta.discourse.org/t/issues-with-force-https-proxy-and-invitations/153995/4 "2020-07-12T07:56:40Z")
@hawm I think this is my current configuration.
---
### Author:  [@michaeld](https://meta.discourse.org/u/michaeld)
#### Post date: [July 12, 2020, 8:38am UTC](https://meta.discourse.org/t/issues-with-force-https-proxy-and-invitations/153995/5 "2020-07-12T08:38:06Z")
> [@Felip](#):
>
> `proxy_set_header X-Forwarded-Proto $scheme;`
How are you setting the `$scheme` variable?
---
### Author:  [@Felip](https://meta.discourse.org/u/Felip)
#### Post date: [July 12, 2020, 3:08pm UTC](https://meta.discourse.org/t/issues-with-force-https-proxy-and-invitations/153995/6 "2020-07-12T15:08:20Z")
> [@michaeld](#):
>
> How are you setting the `$scheme` variable?
I don’t, I guess I rely on the [default value](http://nginx.org/en/docs/http/ngx_http_core_module.html#var_scheme), is this wrong?
---
### Author:  [@michaeld](https://meta.discourse.org/u/michaeld)
#### Post date: [July 12, 2020, 4:56pm UTC](https://meta.discourse.org/t/issues-with-force-https-proxy-and-invitations/153995/7 "2020-07-12T16:56:34Z")
If you’re proxying, this can go wrong. In my experience this is the #1 reason for the issues you are describing. Try to set it to “https” instead (maybe just skip the variable, just put “https” there).
---
### Author:  [@Felip](https://meta.discourse.org/u/Felip)
#### Post date: [July 13, 2020, 8:13am UTC](https://meta.discourse.org/t/issues-with-force-https-proxy-and-invitations/153995/8 "2020-07-13T08:13:23Z")
@michaeld yes! You nailed it! Thank you so much!
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [August 12, 2020, 8:13am UTC](https://meta.discourse.org/t/issues-with-force-https-proxy-and-invitations/153995/9 "2020-08-12T08:13:25Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.