X-Forward-Proto: https is unconditionally added to the default_frontend when SSL is enabled about dockercloud-haproxy

[tifayuki]

True, but we cannot tell if the incoming request is http or https only based on port number.

In Case 1, the fix could be separate port 80 and 443 into two different frontend.

In Case 2, part of the logs shows:

frontend port_443
  bind :443 ssl crt /certs/
  reqadd X-Forwarded-Proto:\ https
  acl is_websocket hdr(Upgrade) -i WebSocket
  acl host_rule_2 hdr_reg(host) -i ^.*$
  acl host_rule_2_port hdr_reg(host) -i ^.*:443$
  use_backend SERVICE_WEB if host_rule_2 or host_rule_2_port
frontend port_80
  bind :80
  acl is_websocket hdr(Upgrade) -i WebSocket
  acl host_rule_1 hdr_reg(host) -i ^.*$
  acl host_rule_1_port hdr_reg(host) -i ^.*:80$
  use_backend SERVICE_WEB if host_rule_1 or host_rule_1_port

I think this is as expected. The 443 frontend has the correct x-forwarded-proto, and the 80 frontend doesn't have it because it is not specify by EXTRA_SETTINGS explicitly.

[tifayuki]

Fixed in version 1.4

[nickbreen]

True, but we cannot tell if the incoming request is http or https only based on port number.
Out of curiosity, why is this the case?

I (naively) assumed that it would have been safe to assume that the ports dictated the protocol based on the frontends' configurations.