benoitc/gunicorn — Issue #281: `secure_scheme_headers` should default to an empty dict
Author: johnboxall
Created: 2011-11-09 03:48:05+00:00
State: open

From the docs:

It is important that your front-end proxy configuration ensures that the headers defined here can not be passed directly from the client.

I was surprised this was the default setting.

It looks like Django will standardize on something similiar: https://code.djangoproject.com/ticket/14597