An app trusts X-Forwarded-Proto from one proxy hop and starts misclassifying secure requests

A reverse proxy or CDN is inserted ahead of an existing app and secure redirect or cookie behavior becomes inconsistent.