# Moved site behind proxy, favicon and header not using https anymore
**URL:** https://meta.discourse.org/t/moved-site-behind-proxy-favicon-and-header-not-using-https-anymore/131486
**Category:** Support
**Created:** [October 20, 2019, 3:26pm UTC](https://meta.discourse.org/t/moved-site-behind-proxy-favicon-and-header-not-using-https-anymore/131486 "2019-10-20T15:26:29Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@jessicah](https://meta.discourse.org/u/jessicah)
#### Post date: [October 20, 2019, 3:26pm UTC](https://meta.discourse.org/t/moved-site-behind-proxy-favicon-and-header-not-using-https-anymore/131486/1 "2019-10-20T15:26:30Z")
I’ve since moved my Discourse instance between servers, and is now running behind a reverse proxy with SSL termination.
However, the header image and favicon are not being requested over HTTPS and getting blocked. I tried setting “force https” to on, but this hasn’t helped.
---
### Author:  [@michaeld](https://meta.discourse.org/u/michaeld)
#### Post date: [October 20, 2019, 3:43pm UTC](https://meta.discourse.org/t/moved-site-behind-proxy-favicon-and-header-not-using-https-anymore/131486/2 "2019-10-20T15:43:19Z")
Is your proxy supplying an `X-Forwarded-Proto` header? (It should).
---
### Author:  [@jessicah](https://meta.discourse.org/u/jessicah)
#### Post date: [October 24, 2019, 7:36pm UTC](https://meta.discourse.org/t/moved-site-behind-proxy-favicon-and-header-not-using-https-anymore/131486/3 "2019-10-24T19:36:44Z")
> Is your proxy supplying an `X-Forwarded-Proto` header? (It should).
Yes it is.
---
### Author:  [@figure002](https://meta.discourse.org/u/figure002)
#### Post date: [October 24, 2019, 8:51pm UTC](https://meta.discourse.org/t/moved-site-behind-proxy-favicon-and-header-not-using-https-anymore/131486/4 "2019-10-24T20:51:52Z")
I had the same issue. I have a Discourse instance behind HAProxy with SSL termination. The fix is pretty simple, but not obvious:
1. First make sure that “force https” is enabled in the settings (go to Settings and filter by “force https”).
2. Go to Settings \> Branding \> and just re-upload your logos.
3. Everything should use HTTPS now (be sure to hit your browser refresh button).
(I think this may be a bug in Discourse)
---
### Author:  [@rossierd](https://meta.discourse.org/u/rossierd)
#### Post date: [May 15, 2020, 3:31pm UTC](https://meta.discourse.org/t/moved-site-behind-proxy-favicon-and-header-not-using-https-anymore/131486/5 "2020-05-15T15:31:32Z")
Hello,
I’d like to come back along this issue. Actually, I’ve the same problem, and I can’t use force\_https to true since there is no way to login… (Unknown error at the login).
How can we force the logo to be referenced with a https request and not http?
Shouldn’t it be easy?
So many thanks for your feedback (so many many hours spent on my side to fix this).
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [May 15, 2020, 4:58pm UTC](https://meta.discourse.org/t/moved-site-behind-proxy-favicon-and-header-not-using-https-anymore/131486/6 "2020-05-15T16:58:41Z")
You’ll need to flip the `force_https` site setting via SSH-ing into the server and entering the Ruby command line. There are #howto topics on doing that here.
---
### Author:  [@rossierd](https://meta.discourse.org/u/rossierd)
#### Post date: [May 16, 2020, 9:20am UTC](https://meta.discourse.org/t/moved-site-behind-proxy-favicon-and-header-not-using-https-anymore/131486/7 "2020-05-16T09:20:00Z")
Thanks for your reply. I was certainly unclear in my message. Actually, I can manage to change force\_https using rails command, no problem. So, just to be clearer:
Until the last upgrade I’ve performed a couple of days ago which needed to rebuild the docker container, I had a full running solution using force\_https to true and with the following patch I had to apply in server section of nginx config file in order to get a valid login:
```
if ($http_x_forwarded_proto = 'http'){
return 301 https://$host$request_uri;
}
```
And it worked. However, since the upgrade, the same patch did not allow me to log in again, getting the well known “Unknown error”
I got the following trace from the production log:
```
Started POST "/session" for 193.134.222.4 at 2020-05-14 19:24:40 +0000
Processing by SessionController#create as */*
Parameters: {"login"=>"rossierd", "password"=>"[FILTERED]", "second_factor_method"=>"1", "timezone"=>"Europe/Zurich"}
Can't verify CSRF token authenticity.
Rendering text template
Rendered text template (Duration: 0.0ms | Allocations: 1)
Filter chain halted as :verify_authenticity_token rendered or redirected
Completed 403 Forbidden in 2ms (Views: 0.7ms | ActiveRecord: 0.0ms | Allocations: 1101)
```
Provided that we have our discourse container running in a VM which is accessible through https.
Do you have any idea about the cause of this change of behaviour before and after the upgrade?
So far, I disabled force\_https to false, everything runs well except the logo at the top left (brand logo) which does not appear correctly since it is referred using an http:// request…
By the way, here is the URL of our site: [https://discourse.heig-vd.ch](https://discourse.heig-vd.ch)
---
### Author:  [@rossierd](https://meta.discourse.org/u/rossierd)
#### Post date: [May 17, 2020, 6:39am UTC](https://meta.discourse.org/t/moved-site-behind-proxy-favicon-and-header-not-using-https-anymore/131486/8 "2020-05-17T06:39:29Z")
In addition, I also found the following site setting which has the guilty URL:
SiteSetting.site\_favicon\_url (another is SiteSetting.site\_apple\_touch\_icon) with the “http://…jpeg”.
However, it seems not obvious to change the value with a simple rail command as we do with force\_https for example)…
---
### Author:  [@rossierd](https://meta.discourse.org/u/rossierd)
#### Post date: [May 21, 2020, 10:37am UTC](https://meta.discourse.org/t/moved-site-behind-proxy-favicon-and-header-not-using-https-anymore/131486/9 "2020-05-21T10:37:20Z")
Please, any help about this topic?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [May 21, 2020, 6:33pm UTC](https://meta.discourse.org/t/moved-site-behind-proxy-favicon-and-header-not-using-https-anymore/131486/10 "2020-05-21T18:33:19Z")
You set those via the setup wizard. Re-run the setup wizard and re-upload the images.
---
### Author:  [@rossierd](https://meta.discourse.org/u/rossierd)
#### Post date: [May 22, 2020, 8:28am UTC](https://meta.discourse.org/t/moved-site-behind-proxy-favicon-and-header-not-using-https-anymore/131486/11 "2020-05-22T08:28:25Z")
I set the images like that. I re-launched the wizard, but with the same effect at the end ☹
I guess uploading the pictures does not impact on the way how they are referred; it is more a thing related to the web page generation.
---
### Author:  [@rossierd](https://meta.discourse.org/u/rossierd)
#### Post date: [May 26, 2020, 1:08pm UTC](https://meta.discourse.org/t/moved-site-behind-proxy-favicon-and-header-not-using-https-anymore/131486/12 "2020-05-26T13:08:23Z")
Well, after so many unsuccessful attempts, I finally figured out how to have a valid login with force\_https=true.
In the docker env., I patched /etc/nginx/conf.d/discourse.conf as follows:
> …
> location @discourse {
> limit\_conn connperip 20;
> limit\_req zone=flood burst=12 nodelay;
> limit\_req zone=bot burst=100 nodelay;
> proxy\_set\_header Host $http\_host;
> proxy\_set\_header X-Request-Start “t=${msec}”;
> proxy\_set\_header X-Real-IP $remote\_addr;
> proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;
> proxy\_set\_header X-Forwarded-Proto https; # $thescheme; ← What I modified
> proxy\_pass [http://discourse](http://discourse);
> }
> …
And it **only** works in this section, at least with my environment.
Works great now!