# Moved site behind proxy, favicon and header not using https anymore

**URL:** https://meta.discourse.org/t/moved-site-behind-proxy-favicon-and-header-not-using-https-anymore/131486
**Category:** Support
**Created:** [October 20, 2019, 3:26pm UTC](https://meta.discourse.org/t/moved-site-behind-proxy-favicon-and-header-not-using-https-anymore/131486 "2019-10-20T15:26:29Z")
**Posts on this page:** 1
**Showing post:** 7

<div class="post-metadata">

### Author: ![rossierd](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/rossierd/32/164604_2.png) [@rossierd](https://meta.discourse.org/u/rossierd)
#### Post date: [May 16, 2020, 9:20am UTC](https://meta.discourse.org/t/moved-site-behind-proxy-favicon-and-header-not-using-https-anymore/131486/7 "2020-05-16T09:20:00Z")

</div>

Thanks for your reply. I was certainly unclear in my message. Actually, I can manage to change force\_https using rails command, no problem. So, just to be clearer:  
Until the last upgrade I’ve performed a couple of days ago which needed to rebuild the docker container, I had a full running solution using force\_https to true and with the following patch I had to apply in server section of nginx config file in order to get a valid login:

```
  if ($http_x_forwarded_proto = 'http'){
    return 301 https://$host$request_uri;
  }

```

And it worked. However, since the upgrade, the same patch did not allow me to log in again, getting the well known “Unknown error”  
I got the following trace from the production log:

```
 Started POST "/session" for 193.134.222.4 at 2020-05-14 19:24:40 +0000
 Processing by SessionController#create as */*
 Parameters: {"login"=>"rossierd", "password"=>"[FILTERED]", "second_factor_method"=>"1", "timezone"=>"Europe/Zurich"}
 Can't verify CSRF token authenticity.
 Rendering text template
 Rendered text template (Duration: 0.0ms | Allocations: 1)
 Filter chain halted as :verify_authenticity_token rendered or redirected
 Completed 403 Forbidden in 2ms (Views: 0.7ms | ActiveRecord: 0.0ms | Allocations: 1101)

```

Provided that we have our discourse container running in a VM which is accessible through https.

Do you have any idea about the cause of this change of behaviour before and after the upgrade?

So far, I disabled force\_https to false, everything runs well except the logo at the top left (brand logo) which does not appear correctly since it is referred using an http:// request…

By the way, here is the URL of our site: [https://discourse.heig-vd.ch](https://discourse.heig-vd.ch)

---

_[View the full topic](https://meta.discourse.org/t/moved-site-behind-proxy-favicon-and-header-not-using-https-anymore/131486)._