Challenge 2: Backend Redirecting to http:// Despite HTTPS Everywhere — Solution Walkthrough

The likely missing piece:

The X-Forwarded-Proto header is most likely missing from the Nginx
configuration. Per this chapter's own material, TLS is terminated at
Nginx (Web Servers Fundamentals Chapter 7), meaning Nginx's own
internal connection to the backend is plain HTTP even though every
real client reaches the site over HTTPS. Without X-Forwarded-Proto,
the backend has no way of knowing the original request actually
arrived over HTTPS — from its own perspective, every request looks
like plain HTTP, since that's the only connection it can actually see.

Why this produces the observed behavior:

Many application frameworks generate redirect URLs (and decide
whether to mark cookies as secure) based on what protocol they
believe the original request used. If the backend believes every
request is HTTP because it has no X-Forwarded-Proto header to tell it
otherwise, it will generate http:// redirect URLs by default, exactly
matching the reported symptom.

The fix:

Add the directive covered in this chapter:

  proxy_set_header X-Forwarded-Proto $scheme;

and configure the backend application to trust and read this header
when determining the original request's protocol, rather than relying
solely on its own direct (and here, misleading) connection type.

WHY THIS WORKS AS AN ANSWER
------------------------------
This exercise applies this chapter's own X-Forwarded-Proto material to
a concrete, realistic symptom, correctly tracing the observed bug back
to the missing header rather than a more generic "something's
misconfigured" answer.