{"action":"created","issue":{"url":"https://api.github.com/repos/auraphp/Aura.Router/issues/89","labels_url":"https://api.github.com/repos/auraphp/Aura.Router/issues/89/labels{/name}","comments_url":"https://api.github.com/repos/auraphp/Aura.Router/issues/89/comments","events_url":"https://api.github.com/repos/auraphp/Aura.Router/issues/89/events","html_url":"https://github.com/auraphp/Aura.Router/pull/89","id":77365614,"number":89,"title":"Support serverIsSecure if code is behind the proxy","user":{"login":"maskas","id":1159983,"avatar_url":"https://avatars.githubusercontent.com/u/1159983?v=3","gravatar_id":"","url":"https://api.github.com/users/maskas","html_url":"https://github.com/maskas","followers_url":"https://api.github.com/users/maskas/followers","following_url":"https://api.github.com/users/maskas/following{/other_user}","gists_url":"https://api.github.com/users/maskas/gists{/gist_id}","starred_url":"https://api.github.com/users/maskas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/maskas/subscriptions","organizations_url":"https://api.github.com/users/maskas/orgs","repos_url":"https://api.github.com/users/maskas/repos","events_url":"https://api.github.com/users/maskas/events{/privacy}","received_events_url":"https://api.github.com/users/maskas/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-05-17T18:26:24Z","updated_at":"2015-05-26T17:21:43Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/auraphp/Aura.Router/pulls/89","html_url":"https://github.com/auraphp/Aura.Router/pull/89","diff_url":"https://github.com/auraphp/Aura.Router/pull/89.diff","patch_url":"https://github.com/auraphp/Aura.Router/pull/89.patch"},"body":""},"comment":{"url":"https://api.github.com/repos/auraphp/Aura.Router/issues/comments/105610542","html_url":"https://github.com/auraphp/Aura.Router/pull/89#issuecomment-105610542","issue_url":"https://api.github.com/repos/auraphp/Aura.Router/issues/89","id":105610542,"user":{"login":"pmjones","id":25754,"avatar_url":"https://avatars.githubusercontent.com/u/25754?v=3","gravatar_id":"","url":"https://api.github.com/users/pmjones","html_url":"https://github.com/pmjones","followers_url":"https://api.github.com/users/pmjones/followers","following_url":"https://api.github.com/users/pmjones/following{/other_user}","gists_url":"https://api.github.com/users/pmjones/gists{/gist_id}","starred_url":"https://api.github.com/users/pmjones/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pmjones/subscriptions","organizations_url":"https://api.github.com/users/pmjones/orgs","repos_url":"https://api.github.com/users/pmjones/repos","events_url":"https://api.github.com/users/pmjones/events{/privacy}","received_events_url":"https://api.github.com/users/pmjones/received_events","type":"User","site_admin":false},"created_at":"2015-05-26T17:21:43Z","updated_at":"2015-05-26T17:21:43Z","body":"Thanks for your patience.\r\n\r\nReading those links, they all (especially the typo3 one) seem very \"iffy\" about implementing it themselves, and point out that that it's not terribly secure. That, plus [this twitter exchange](https://twitter.com/pmjones/status/602870183317778432), make me think that relying on the header alone is a problem. It looks too easy to fake, and thus subvert the \"secure\" flag on the route.\r\n\r\nNow, having said that, it might be that there's some more-secure way of checking the forwarded protocol. This series of methods in [Aura\\Web\\Request\\Client](https://github.com/auraphp/Aura.Web/blob/2.x/src/Request/Client.php#L330-L398) may be useful in that regard. In particular, there needs to be a way to set a list of trusted proxies.\r\n\r\nAll that strikes me as a bit much for a routing system, but in your case it may actually be needed. As an alternative, perhaps you could check the incoming forwarded-for and forwarded-proto headers before the Router is invoked, and modify $_SERVER['HTTPS'] accordingly? My guess is that would also be more performant, although by how much I can't say.\r\n\r\nFurther thoughts @maskas ?"}}