# Trust proxies so HTTPS sticks

> Behind one load balancer, trustProxies(at: '*') makes Laravel see HTTPS. Do not do that on a machine exposed directly.

- URL: https://laravel-vuejs.space/laravel-trust-proxies-https
- Author: Anass Ez-zouaine (https://laravel-vuejs.space/author/anass-ez-zouaine)
- Published: 2026-10-11
- Topics: Laravel, VueJs, Setup

People searching “Laravel trust proxies HTTPS” get an infinite redirect or a session cookie that will not stick. The app thinks the request is HTTP because the proxy terminated TLS. Generated URLs then use `http`, and `SESSION_SECURE_COOKIE` refuses to send the cookie. The [deploy guide](https://laravel-vuejs.space/deploy-laravel-vue) is the host. This page is the middleware.

> **TL;DR**
>
> -   Behind one load balancer, trustProxies(at: ’\*’) makes Laravel see HTTPS.
> -   Do not do that on a machine exposed directly.
> -   Do not set `URL::forceScheme('https')` and also forget the proxy.
>
> **Who it's for:** Laravel + Vue developers
>
> **Applies to:** Laravel 13 · Vue 3

## The fix

On Laravel 11 and newer, in `bootstrap/app.php`:

```php
->withMiddleware(function (Middleware $middleware) {
    $middleware->trustProxies(at: '*');
})
```

`at: '*'` trusts every proxy. That is right when the app is only reachable through the load balancer. It is wrong when the process is on a public port, because a client can send `X-Forwarded-For` and `X-Forwarded-Proto` itself.

`APP_URL` should still be the `https` URL users type. Trusting proxies does not replace it.

## What to avoid

> **Gotcha**
>
> Do not set `URL::forceScheme('https')` and also forget the proxy. You can end up with https URLs and a request object that still says the scheme is http. Fix the proxy headers first.

## FAQ

**Q: How do I trust proxies so HTTPS sticks?**

Behind one load balancer, trustProxies(at: '\*') makes Laravel see HTTPS. Do not do that on a machine exposed directly.

**Q: What goes wrong with Laravel trust proxies HTTPS?**

Many developers get an infinite redirect or a session cookie that will not stick. Do not set `URL::forceScheme('https')` and also forget the proxy.