{"record":{"id":"1b93ea8f322afc89","repo":"HumanSignal/label-studio","slug":"secure-proxy-ssl-header-must-be-configured-as-he","errorCode":null,"errorMessage":"SECURE_PROXY_SSL_HEADER must be configured as \"<header>,<value>\", for example \"HTTP_X_FORWARDED_PROTO,https\".","messagePattern":"SECURE_PROXY_SSL_HEADER must be configured as \"<header>,<value>\", for example \"HTTP_X_FORWARDED_PROTO,https\"\\.","errorType":"exception","errorClass":"ImproperlyConfigured","httpStatus":null,"severity":"error","filePath":"label_studio/core/settings/base.py","lineNumber":132,"sourceCode":"FRONTEND_HMR = get_bool_env('FRONTEND_HMR', False)\nFRONTEND_HOSTNAME = get_env('FRONTEND_HOSTNAME', 'http://localhost:8010' if FRONTEND_HMR else HOSTNAME)\n\nDOMAIN_FROM_REQUEST = get_bool_env('DOMAIN_FROM_REQUEST', False)\n\nif DOMAIN_FROM_REQUEST:\n    # in this mode HOSTNAME can be only subpath\n    if HOSTNAME and not HOSTNAME.startswith('/'):\n        raise ImproperlyConfigured('LABEL_STUDIO_HOST must be a subpath if DOMAIN_FROM_REQUEST is True')\n\n\ndef _get_secure_proxy_ssl_header():\n    value = get_env('SECURE_PROXY_SSL_HEADER')\n    if not value:\n        return None\n\n    parts = [part.strip() for part in value.split(',')]\n    if len(parts) != 2 or not all(parts):\n        raise ImproperlyConfigured(\n            'SECURE_PROXY_SSL_HEADER must be configured as \"<header>,<value>\", '\n            'for example \"HTTP_X_FORWARDED_PROTO,https\".'\n        )\n    return tuple(parts)\n\n\nSECURE_PROXY_SSL_HEADER = _get_secure_proxy_ssl_header()\nUSE_X_FORWARDED_HOST = get_bool_env('USE_X_FORWARDED_HOST', False)\nUSE_X_FORWARDED_PORT = get_bool_env('USE_X_FORWARDED_PORT', False)\n\nINTERNAL_PORT = '8080'\n\n# SECURITY WARNING: don't run with debug turned on in production!\nDEBUG = get_bool_env('DEBUG', True)\nDEBUG_MODAL_EXCEPTIONS = get_bool_env('DEBUG_MODAL_EXCEPTIONS', True)\n\n# Whether to verify SSL certs when making external requests, eg in the uploader\n# ⚠️ Turning this off means assuming risk. ⚠️","sourceCodeStart":114,"sourceCodeEnd":150,"githubUrl":"https://github.com/HumanSignal/label-studio/blob/0b49e9b53917880baf1dd85d574fe5541a9aafb2/label_studio/core/settings/base.py#L114-L150","documentation":"_get_secure_proxy_ssl_header parses the SECURE_PROXY_SSL_HEADER env var, which must contain exactly two comma-separated non-empty parts (header name and value), mirroring Django's setting of the same name. If splitting on ',' doesn't yield two non-empty strings, ImproperlyConfigured is raised; if unset/empty it returns None.","triggerScenarios":"Setting SECURE_PROXY_SSL_HEADER to a value without exactly two non-empty comma-separated parts — e.g. 'HTTP_X_FORWARDED_PROTO' (one part), 'HTTP_X_FORWARDED_PROTO,' (empty part), or 'a,b,c' (three parts).","commonSituations":"Copying Django's tuple syntax (\"HTTP_X_FORWARDED_PROTO\", \"https\") verbatim including quotes into a single env var; shell stripping; forgetting the value half; using colons or semicolons instead of a comma.","solutions":["Format the env var as exactly \"<header>,<value>\", e.g. SECURE_PROXY_SSL_HEADER=HTTP_X_FORWARDED_PROTO,https.","Avoid extra quotes around the whole value; keep a single comma with both parts non-empty (whitespace is stripped).","If you don't need it, unset the variable — the function returns None.","If your proxy needs multiple headers, Django's format only supports one pair; pick the relevant header."],"exampleFix":"// before\nSECURE_PROXY_SSL_HEADER=\"HTTP_X_FORWARDED_PROTO\"\n// after\nSECURE_PROXY_SSL_HEADER=HTTP_X_FORWARDED_PROTO,https","handlingStrategy":"validation","validationCode":"import os, re\nv = os.environ.get('SECURE_PROXY_SSL_HEADER')\nif v:\n    parts = [p.strip() for p in v.split(',')]\n    if len(parts) != 2 or not all(parts):\n        raise SystemExit('SECURE_PROXY_SSL_HEADER must be \"<header>,<value>\" e.g. HTTP_X_FORWARDED_PROTO,https')","typeGuard":null,"tryCatchPattern":"try:\n    from django.core.handlers.wsgi import WSGIHandler  # settings load\nexcept ImproperlyConfigured as e:\n    if 'SECURE_PROXY_SSL_HEADER' in str(e):\n        logger.error('Fix SECURE_PROXY_SSL_HEADER env: %s', e)\n    raise","preventionTips":["Copy the documented example format exactly: HTTP_X_FORWARDED_PROTO,https.","Avoid shell quoting pitfalls (no embedded quotes or extra commas).","Test the env var parsing in CI with a sample value.","Only set it when terminating TLS at a trusted proxy."],"tags":["configuration","django","ssl","environment-variables"],"backgroundTag":"invalid-env-var-format","analyzedSha":"0b49e9b53917880baf1dd85d574fe5541a9aafb2","analyzedAt":"2026-08-29T00:39:52.578Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}