From 5d92d91432c009b351fa9409eb87aa3d82ff356a Mon Sep 17 00:00:00 2001
From: Marijn Doeve <marijn@doeve.me>
Date: Wed, 8 Jul 2026 09:45:07 +0200
Subject: [PATCH] fix: trust X-Forwarded-Proto header from Traefik proxy (#189)

Traefik terminates TLS and forwards requests over HTTP internally,
setting X-Forwarded-Proto: https. Without trusting this header,
Symfony generates http:// URLs (e.g. in password reset emails).
---
 config/packages/framework.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/packages/framework.yaml b/config/packages/framework.yaml
index d9a67d4..fc45578 100644
--- a/config/packages/framework.yaml
+++ b/config/packages/framework.yaml
@@ -14,7 +14,7 @@ when@prod:
         # shortcut for private IP address ranges of your proxy
         trusted_proxies: 'private_ranges'
         # or, if your proxy instead uses the "Forwarded" header
-        trusted_headers: [ 'forwarded' ]
+        trusted_headers: [ 'x-forwarded-proto' ]
 
 when@test:
     framework: