People searching “Laravel trust proxies HTTPS” get an infinite redirect or a session cookie that will not stick. The app thinks the request is HTTP because the proxy terminated TLS. Generated URLs then use http, and SESSION_SECURE_COOKIE refuses to send the cookie. The deploy guide is the host. This page is the middleware.
TL;DR
- Behind one load balancer, trustProxies(at: ’*’) makes Laravel see HTTPS.
- Do not do that on a machine exposed directly.
- Do not set
URL::forceScheme('https')and also forget the proxy.
The fix#
On Laravel 11 and newer, in bootstrap/app.php:
->withMiddleware(function (Middleware $middleware) {
$middleware->trustProxies(at: '*');
})at: '*' trusts every proxy. That is right when the app is only reachable through the load balancer. It is wrong when the process is on a public port, because a client can send X-Forwarded-For and X-Forwarded-Proto itself.
APP_URL should still be the https URL users type. Trusting proxies does not replace it.
What to avoid#
Gotcha
Do not set URL::forceScheme('https') and also forget the proxy. You can end up with https URLs and a request object that still says the scheme is http. Fix the proxy headers first.
FAQ#
How do I trust proxies so HTTPS sticks?
Behind one load balancer, trustProxies(at: '*') makes Laravel see HTTPS. Do not do that on a machine exposed directly.
What goes wrong with Laravel trust proxies HTTPS?
Many developers get an infinite redirect or a session cookie that will not stick. Do not set URL::forceScheme('https') and also forget the proxy.
