joomla/joomla-framework — pull request #212 by piotr-cz (2013-09-01 11:19:55+00:00)
Title:  Improved SSL (https) detection in AbstractWebApplication

Apparently, when behind load balancer, it terminates the SSL connection and forwards on port 80.
In effect the `$_SERVER['HTTPS']` header is not present anymore, but `$_SERVER['HTTP_X_FORWARDED_PROTO'] = 'https'` is.

Resources:
- Wikipedia: [Common non-standard request headers](http://en.wikipedia.org/wiki/List_of_HTTP_header_fields#Common_non-standard_request_headers) > X-Forwarded-Proto

> a de facto standard for identifying the originating protocol of an HTTP request, since a reverse proxy (load balancer) may communicate with a web server using HTTP even if the request to the reverse proxy is HTTPS

- StackOverflow: [Detecting https requests in php](http://stackoverflow.com/questions/452375/detecting-https-requests-in-php#answer-9031882)

- Wordpress: [Request: modify is_ssl() function to check for HTTP_X_FORWARDED_PROTO](http://wordpress.org/support/topic/request-modify-is_ssl-function-to-check-for-http_x_forwarded_proto)

- Random github issue: [Respect the header HTTP_X_FORWARDED_PROTO](https://github.com/puma/puma/pull/200)

Quick and dirty worakound to set HTTPS header manually in `.htaccess`:
```

RewriteEngine On
RewriteCond %{HTTP:X-FORWARDED-PROTO} ^https$
RewriteCond %{HTTP:X-SSL-CIPHER} !^$
RewriteRule ^(.*)$ - [E=HTTPS:on]

```