http: Support inferring X-Forwarded-Proto from PROXY protocol destination port by prashanthjos · Pull Request #43088 · envoyproxy/envoy

prashanthjos · 2026-01-21T03:55:17Z

Commit Message: http: add support for inferring x-forwarded-proto from PROXY protocol destination port

Additional Description:

When using Layer 4 load balancers (like AWS NLB) that terminate TLS and forward traffic using PROXY protocol, Envoy receives unencrypted traffic but needs to know the original protocol for correct redirect behavior.

This change adds a new HCM configuration option forwarded_proto_config that allows specifying which PROXY protocol destination ports should be treated as HTTPS or HTTP. When enabled and the local address was restored from PROXY protocol, the x-forwarded-proto header is set based on whether the destination port is in https_destination_ports or http_destination_ports.

Example configuration:

http_connection_manager:
  forwarded_proto_config:
    https_destination_ports: [443, 8443]
    http_destination_ports: [80, 8080]

Risk Level: Low - opt-in feature that only activates when explicitly configured and when localAddressRestored() is true
Testing: Added 6 unit tests in conn_manager_utility_test.cc covering port 443/80 mapping, unmapped ports, empty config, non-restored address, and custom ports
Docs Changes: N/A
Release Notes: Added
Platform Specific Features:
[Optional Runtime guard:]
Fixes #43031
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
API Considerations: Added new message ForwardedProtoConfig and field forwarded_proto_config (#61) to HttpConnectionManager. The configuration uses two repeated uint32 fields (https_destination_ports and http_destination_ports) for type-safe port specification without requiring string validation.

… destination port When using Layer 4 load balancers (like AWS NLB) that terminate TLS and forward traffic using PROXY protocol, Envoy receives unencrypted traffic but needs to know the original protocol for correct redirect behavior. This change adds a new HCM configuration option `set_forwarded_proto_from_proxy_protocol_destination_port` that allows mapping PROXY protocol destination ports to schemes (e.g., 443 -> https, 80 -> http). When enabled and the local address was restored from PROXY protocol, the x-forwarded-proto header is set based on the configured port-to-scheme mapping. Signed-off-by: Prashanth Josyula <prashanth.16@gmail.com>

Signed-off-by: Prashanth Josyula <prashanth.16@gmail.com>

repokitteh-read-only · 2026-01-21T03:55:27Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to (api/envoy/|docs/root/api-docs/).
envoyproxy/api-shepherds assignee is @wbpcode
CC @envoyproxy/api-watchers: FYI only for changes made to (api/envoy/|docs/root/api-docs/).

🐱

Caused by: #43088 was opened by prashanthjos.

see: more, trace.

Signed-off-by: Prashanth Josyula <prashanth.16@gmail.com>

prashanthjos · 2026-01-21T17:08:04Z

@mattklein123 and @yanavlasov can you please take a look at this PR

wbpcode

Thanks for this contribution. Some comments to API first.

wbpcode · 2026-01-26T08:09:05Z

api/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto

+// Configuration for setting x-forwarded-proto based on PROXY protocol destination port.
+// This enables Envoy to infer the original protocol (HTTP/HTTPS) when behind an L4 load
+// balancer that terminates TLS and uses PROXY protocol.
+message SetForwardedProtoFromProxyProtocolDestinationPort {


ForwardedProtoOptions or ForwardedProtoConfig. We may could support other more flexible solution in the future.

wbpcode · 2026-01-26T08:10:33Z

api/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto

+  //
+  // The scheme values must be either "http" or "https".
+  // Invalid scheme values will be rejected during configuration loading.
+  map<uint32, string> port_scheme_mappings = 1;


Rather then a string, maybe https_destination_ports and http_destination_ports with type repeated uint32 be better?

Done changed!

Signed-off-by: Prashanth Josyula <prashanth.16@gmail.com>

prashanthjos · 2026-01-27T05:33:50Z

/retest

prashanthjos · 2026-01-27T05:50:02Z

@wbpcode I have addressed your comments can you please take a look

wbpcode

LGTM overall with one last comment. Thanks for the update.

wbpcode · 2026-01-27T08:50:01Z

api/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto

+  //
+  // If not configured, defaults to disabled and the standard behavior applies (using connection
+  // TLS status or trusted downstream headers).
+  ForwardedProtoConfig forwarded_proto_config = 61;


Sorry for the regression. May name the API to ForwardProtoConfig, to keep same style with exsiting ForwardClientCertConfig.

Signed-off-by: Prashanth Josyula <prashanth.16@gmail.com>

prashanthjos · 2026-01-28T05:09:42Z

/retest

prashanthjos · 2026-01-28T05:43:07Z

@wbpcode addressed your comments !

wbpcode

LGTM. Thanks.

wbpcode · 2026-01-28T14:25:05Z

Hello, @yanavlasov, i see you assign this to yourself? is there any additional concern from you?

…tion port (envoyproxy#43088) When using Layer 4 load balancers (like AWS NLB) that terminate TLS and forward traffic using PROXY protocol, Envoy receives unencrypted traffic but needs to know the original protocol for correct redirect behavior. This change adds a new HCM configuration option `forwarded_proto_config` that allows specifying which PROXY protocol destination ports should be treated as HTTPS or HTTP. When enabled and the local address was restored from PROXY protocol, the `x-forwarded-proto` header is set based on whether the destination port is in `https_destination_ports` or `http_destination_ports`. Example configuration: ``` http_connection_manager: forwarded_proto_config: https_destination_ports: [443, 8443] http_destination_ports: [80, 8080] ``` Risk Level: Low - opt-in feature that only activates when explicitly configured and when localAddressRestored() is true Testing: Added 6 unit tests in conn_manager_utility_test.cc covering port 443/80 mapping, unmapped ports, empty config, non-restored address, and custom ports Docs Changes: N/A Release Notes: Added Platform Specific Features: [Optional Runtime guard:] Fixes envoyproxy#43031 [Optional Fixes commit #PR or SHA] [Optional Deprecated:] API Considerations: Added new message ForwardedProtoConfig and field forwarded_proto_config (envoyproxy#61) to HttpConnectionManager. The configuration uses two repeated uint32 fields (https_destination_ports and http_destination_ports) for type-safe port specification without requiring string validation. --------- Signed-off-by: Prashanth Josyula <prashanth.16@gmail.com>

…tion port (envoyproxy#43088) When using Layer 4 load balancers (like AWS NLB) that terminate TLS and forward traffic using PROXY protocol, Envoy receives unencrypted traffic but needs to know the original protocol for correct redirect behavior. This change adds a new HCM configuration option `forwarded_proto_config` that allows specifying which PROXY protocol destination ports should be treated as HTTPS or HTTP. When enabled and the local address was restored from PROXY protocol, the `x-forwarded-proto` header is set based on whether the destination port is in `https_destination_ports` or `http_destination_ports`. Example configuration: ``` http_connection_manager: forwarded_proto_config: https_destination_ports: [443, 8443] http_destination_ports: [80, 8080] ``` Risk Level: Low - opt-in feature that only activates when explicitly configured and when localAddressRestored() is true Testing: Added 6 unit tests in conn_manager_utility_test.cc covering port 443/80 mapping, unmapped ports, empty config, non-restored address, and custom ports Docs Changes: N/A Release Notes: Added Platform Specific Features: [Optional Runtime guard:] Fixes envoyproxy#43031 [Optional Fixes commit #PR or SHA] [Optional Deprecated:] API Considerations: Added new message ForwardedProtoConfig and field forwarded_proto_config (envoyproxy#61) to HttpConnectionManager. The configuration uses two repeated uint32 fields (https_destination_ports and http_destination_ports) for type-safe port specification without requiring string validation. --------- Signed-off-by: Prashanth Josyula <prashanth.16@gmail.com> Signed-off-by: Gustavo <grnmeira@gmail.com>

prashanthjos added 4 commits January 20, 2026 23:54

Correcting the format

7827776

Signed-off-by: Prashanth Josyula <prashanth.16@gmail.com>

prashanthjos requested review from mattklein123 and yanavlasov as code owners January 21, 2026 03:55

repokitteh-read-only bot added the api label Jan 21, 2026

repokitteh-read-only bot assigned wbpcode Jan 21, 2026

prashanthjos added 3 commits January 21, 2026 04:40

Adding the corrected headers.rst

0e4951f

Signed-off-by: Prashanth Josyula <prashanth.16@gmail.com>

Adding more tests to increase the code coverage

e4fe0a0

Signed-off-by: Prashanth Josyula <prashanth.16@gmail.com>

Adding more tests to increase the code coverage

793bf60

Signed-off-by: Prashanth Josyula <prashanth.16@gmail.com>

yanavlasov self-assigned this Jan 22, 2026

wbpcode reviewed Jan 26, 2026

View reviewed changes

accomodating the review comments

f37fc91

Signed-off-by: Prashanth Josyula <prashanth.16@gmail.com>

wbpcode reviewed Jan 27, 2026

View reviewed changes

accomodating the review comments

8b7abfe

Signed-off-by: Prashanth Josyula <prashanth.16@gmail.com>

wbpcode approved these changes Jan 28, 2026

View reviewed changes

repokitteh-read-only bot removed the api label Jan 28, 2026

yanavlasov approved these changes Jan 29, 2026

View reviewed changes

yanavlasov merged commit f126920 into envoyproxy:main Jan 29, 2026
26 checks passed

zezaeoh mentioned this pull request Jan 30, 2026

Support Envoy's forwarded_proto_config for PROXY Protocol destination port-based X-Forwarded-Proto projectcontour/contour#7392

Open

Conversation

prashanthjos commented Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

repokitteh-read-only bot commented Jan 21, 2026

Uh oh!

prashanthjos commented Jan 21, 2026

Uh oh!

wbpcode left a comment

Choose a reason for hiding this comment

Uh oh!

wbpcode Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

wbpcode Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

prashanthjos Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

prashanthjos commented Jan 27, 2026

Uh oh!

prashanthjos commented Jan 27, 2026

Uh oh!

wbpcode left a comment

Choose a reason for hiding this comment

Uh oh!

wbpcode Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

prashanthjos commented Jan 28, 2026

Uh oh!

prashanthjos commented Jan 28, 2026

Uh oh!

wbpcode left a comment

Choose a reason for hiding this comment

Uh oh!

wbpcode commented Jan 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

prashanthjos commented Jan 21, 2026 •

edited

Loading