Ask for the supported proxy configuration if you do not control the server. Identify which headers are set or replaced and whether clients can reach the application directly.

1. Inspect the incorrect behavior, such as generated HTTP links, redirect loops or a wrong client address. Record the public request and the internal deployment path.

2. Use Werkzeug ProxyFix only when the application is actually behind the relevant trusted proxy. Configure the number of trusted values separately for each forwarded header type.

3. Ensure the edge proxy removes untrusted incoming values or otherwise establishes a reliable chain. Do not assume every header containing a public-looking address is trustworthy.

4. Configure the application’s allowed hosts and secure cookie behavior for the final public origin. Keep proxy trust and hostname validation as distinct controls.

5. Restart the application and test redirects and URL generation from outside the hosting network.

Use this Flask pattern only for a verified deployment with one trusted proxy that replaces X-Forwarded-For and X-Forwarded-Proto, and where visitors cannot reach the upstream directly. Other topologies require different, explicitly reviewed counts.

from werkzeug.middleware.proxy_fix import ProxyFix

app.wsgi_app = ProxyFix(
    app.wsgi_app,
    x_for=1,
    x_proto=1,
    x_host=0,
    x_port=0,
    x_prefix=0,
)

This example intentionally does not trust forwarded host, port or prefix values. Configure the canonical host and cookie settings separately. In staging, submit a harmless forged forwarded header through the public edge and confirm the proxy overwrites it instead of allowing the client to choose the application’s scheme or client identity.

Expected result: Generated HTTPS links and client-address handling match the real request path. The correction resolves the observed proxy symptom without trusting every incoming header.

Verify HTTPS links, the canonical hostname and expected client address. In a controlled test, confirm a forged forwarded header cannot override trusted request information.

A mismatch in proxy counts can trust a client-provided value or ignore a legitimate proxy. Correct the topology information instead of setting every trust count to a large number.

• Deploying a Flask application factory on WSGI hosting
• Managing Flask sessions and secret key rotation
• Troubleshooting browser CORS errors for an API
• Separating Flask background tasks from web requests

• Flask behind a proxy
• Werkzeug ProxyFix