Repository: envoyproxy/envoy
File: api/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto (Protocol Buffers)

Code before:
  // * Other ports → falls back to the current connection's TLS status
  //
  // This allows Envoy to correctly determine the original protocol when behind an L4 load balancer
  // that terminates TLS, enabling proper HTTP→HTTPS redirects and scheme-based routing decisions.
  //
  // Example configuration:
  //
  // .. code-block:: yaml
  //
  //   http_connection_manager:
  //     set_forwarded_proto_from_proxy_protocol_destination_port:
  //       port_scheme_mappings:
  //         443: https
  //         80: http
  //         8443: https
  //
  // If not configured, defaults to disabled and the standard behavior applies (using connection
  // TLS status or trusted downstream headers).
  SetForwardedProtoFromProxyProtocolDestinationPort
      set_forwarded_proto_from_proxy_protocol_destination_port = 61;
}

// Configuration for setting x-forwarded-proto based on PROXY protocol destination port.
// This enables Envoy to infer the original protocol (HTTP/HTTPS) when behind an L4 load
// balancer that terminates TLS and uses PROXY protocol.
message SetForwardedProtoFromProxyProtocolDestinationPort {
  // A map of destination port to scheme. When the PROXY protocol destination port matches
  // a key in this map, the corresponding scheme will be used for the ``x-forwarded-proto`` header.
  //
  // Common mappings:
  //
  // * 443 → "https"
  // * 80 → "http"
  //
  // If the destination port is not found in this map, the behavior falls back to using
  // the current connection's TLS status.
  //
  // The scheme values must be either "http" or "https".
  // Invalid scheme values will be rejected during configuration loading.
  map<uint32, string> port_scheme_mappings = 1;
}

// The configuration to customize local reply returned by Envoy.
message LocalReplyConfig {
  // Configuration of list of mappers which allows to filter and change local response.
  // The mappers will be checked by the specified order until one is matched.
  repeated ResponseMapper mappers = 1;

  // The configuration to form response body from the :ref:`command operators <config_access_log_command_operators>`
  // and to specify response content type as one of: plain/text or application/json.
  //

Review comment (suggestion):
`ForwardedProtoOptions` or `ForwardedProtoConfig`. We may could support other more flexible solution in the future.

Code after:
  // ``http_destination_ports``.
  //
  // Example configuration:
  //
  // .. code-block:: yaml
  //
  //   http_connection_manager:
  //     forward_proto_config:
  //       https_destination_ports: [443, 8443]
  //       http_destination_ports: [80, 8080]
  //
  // If not configured, defaults to disabled and the standard behavior applies (using connection
  // TLS status or trusted downstream headers).
  ForwardProtoConfig forward_proto_config = 61;
}

// Configuration options for setting the ``x-forwarded-proto`` header.
// This message provides flexibility for future enhancements to protocol inference.
message ForwardProtoConfig {
  // List of destination ports that should be treated as HTTPS.
  // When the PROXY protocol destination port matches one of these ports,
  // ``x-forwarded-proto`` will be set to ``https``.
  //
  // Common values: 443, 8443
  repeated uint32 https_destination_ports = 1;

  // List of destination ports that should be treated as HTTP.
  // When the PROXY protocol destination port matches one of these ports,
  // ``x-forwarded-proto`` will be set to ``http``.
  //
  // Common values: 80, 8080
  repeated uint32 http_destination_ports = 2;
}

// The configuration to customize local reply returned by Envoy.
message LocalReplyConfig {
  // Configuration of list of mappers which allows to filter and change local response.
  // The mappers will be checked by the specified order until one is matched.
  repeated ResponseMapper mappers = 1;

  // The configuration to form response body from the :ref:`command operators <config_access_log_command_operators>`
  // and to specify response content type as one of: plain/text or application/json.
  //
  // Example one: "plain/text" ``body_format``.
  //
  // .. validated-code-block:: yaml
  //   :type-name: envoy.config.core.v3.SubstitutionFormatString
  //
  //   text_format: "%LOCAL_REPLY_BODY%:%RESPONSE_CODE%:path=%REQ(:path)%\n"
  //
  // The following response body in "plain/text" format will be generated for a request with