What is X-Forwarded-Proto?

X-Forwarded-Proto is a common non-standard header that tells a downstream application whether the original request reached a proxy over HTTP or HTTPS.

What can it tell you?

When a reverse proxy terminates TLS and forwards HTTP internally, it can preserve that the external connection used https. Applications may use this for redirects and Secure cookies.

How NetKarte shows it

Read X-Forwarded-Proto under Forwarding headers in the HTTP information card and compare it with Protocol under Request in the same card. No input is needed. The former is a received value; the latter is a summary subject to the trust setting, so they need not match. NetKarte considers trusted proxy values when determining Protocol.

Notes

Using an untrusted value can produce incorrect URLs or security decisions. As with other forwarding information, the trusted proxy boundary is essential.

HTTPS outside, HTTP inside

A browser can use HTTPS to a proxy while the proxy uses HTTP to the application. Sending X-Forwarded-Proto: https preserves the original scheme. Different internal transport does not prove the external connection was unencrypted.

Investigate a mismatch

1. Compare the address-bar scheme with X-Forwarded-Proto in HTTP information.
2. Compare NetKarte's Protocol field. It uses this header only when forwarding information is trusted.
3. An administrator can then check TLS termination, overwrite rules, and trust configuration.

Protocol is not a certificate check, cipher assessment, or assurance about every intermediary. Adding an https header yourself does not encrypt a connection.