What causes "proxy: HTTPS to HTTP redirect blocked" in gofiber/fiber?

Fix the upstream to emit https:// in its redirect Location (correct long-term fix).

gofiber/fiber · warning · ErrRedirectDowngrade

proxy: HTTPS to HTTP redirect blocked

Error message

proxy: HTTPS to HTTP redirect blocked

What it means

Returned as ErrRedirectDowngrade by proxy.DoRedirects when an HTTPS upstream responds with a 3xx redirect whose Location points to a plaintext http:// URL and SecurityPolicy.AllowHTTPSDowngrade is false. The guard prevents silent protocol downgrades that would expose credentials, cookies, or Authorization headers over an unencrypted hop. AllowHTTPSDowngrade defaults to false for security.

Source

Thrown at middleware/proxy/security.go:65

var (
	// ErrUpstreamSchemeNotAllowed is returned when the proxied URL uses a
	// scheme outside the configured allowlist (default: http, https).
	ErrUpstreamSchemeNotAllowed = errors.New("proxy: upstream scheme is not allowed")

	// ErrUpstreamHostInvalid is returned when the proxied URL is missing a
	// host or cannot be parsed.
	ErrUpstreamHostInvalid = errors.New("proxy: upstream host is empty or invalid")

	// ErrUpstreamHostBlocked is returned when the proxied URL resolves to
	// an address inside a blocked range (loopback, RFC 1918 private,
	// link-local, multicast, unspecified, or CGNAT) and AllowPrivateIPs
	// is false.
	ErrUpstreamHostBlocked = errors.New("proxy: upstream host resolves to a blocked address")

	// ErrRedirectDowngrade is returned when DoRedirects encounters a
	// redirect from an HTTPS upstream to a plaintext HTTP target and
	// AllowHTTPSDowngrade is false.
	ErrRedirectDowngrade = errors.New("proxy: HTTPS to HTTP redirect blocked")
)

// SecurityPolicy controls runtime security restrictions applied to the
// proxy.Do, proxy.Forward, proxy.DoRedirects, proxy.DoTimeout, and
// proxy.DoDeadline runtime helpers as well as Balancer instances that
// do not supply their own policy via Config.SecurityPolicy.
type SecurityPolicy struct {
	// AllowedSchemes restricts the URL schemes accepted as upstream
	// targets. Empty defaults to []string{schemeHTTP, schemeHTTPS}.
	AllowedSchemes []string

	// AllowPrivateIPs allows upstream hosts to resolve to loopback,
	// private (RFC 1918), link-local, multicast, unspecified, or CGNAT
	// (RFC 6598) addresses. SECURITY: enabling this exposes the proxy
	// to SSRF attacks against internal services such as cloud
	// metadata endpoints. Default: false.
	//
	// DNS-rebinding scope: when false, the resolved IP is re-validated at

View on GitHub (pinned to 9a4c7e57fe)

Solutions

Fix the upstream to emit https:// in its redirect Location (correct long-term fix).
If you accept the plaintext risk for this hop, set SecurityPolicy{AllowHTTPSDowngrade: true} on the proxy Config/policy — credentials may leak on the downgraded hop.
Use proxy.Do (no redirect-following) instead of proxy.DoRedirects to avoid following cross-scheme redirects entirely.
Verify the upstream enforces HSTS / TLS on all hops so no http Location is generated.

Example fix

// before
proxy.DoRedirects(req, 'https://upstream/path')

// after — accept downgrade risk explicitly
policy := proxy.DefaultSecurityPolicy()
policy.AllowHTTPSDowngrade = true
proxy.WithSecurityPolicy(policy)
proxy.DoRedirects(req, 'https://upstream/path')

Defensive patterns

Strategy: try-catch

Try / catch

if err := proxy.DoRedirects(req, target); err != nil {
    if errors.Is(err, proxy.ErrRedirectDowngrade) {
        // upstream tried to redirect from https to http
        return fiber.NewError(fiber.StatusBadGateway, "insecure redirect from upstream")
    }
    return err
}

Prevention

Prefer proxy.Do (no redirect-following) when you don't need cross-scheme redirects.
Ensure upstreams emit https:// in Location headers (correct HSTS / TLS config).
Only enable AllowHTTPSDowngrade on a trusted hop where credential leakage is acceptable.

When it happens

Trigger: proxy.DoRedirects(req, 'https://api.example.com/...') where api.example.com returns 302 Location: http://api.example.com/... (scheme mismatch). Common with misconfigured upstreams that canonicalize to http, or HSTS-less backends behind a TLS-terminating load balancer that advertise http in redirects.

Common situations: Upstream behind a TLS terminator that emits http:// in its redirect Location; mixing schemes across a proxy chain; enabling DoRedirects to follow a login/oauth redirect that crosses schemes; stricter default after a Fiber security-policy upgrade.

Related errors

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/fb95879e623ced97.json. Report an issue: GitHub.