This is because your application isn't trusting the reverse proxy's headers overriding the scheme (the X-Forwarded-Proto header that's passed when it handles a TLS request).

There's a few ways we can fix that:

• If you're running the application straight from uvicorn server, try using the flag --forwarded-allow-ips '*'.

• If you're running gunicorn you can set as well the flag --forwarded-allow-ips="*".

• In either application, you can additionally use the FORWARDED_ALLOW_IPS environment variable.

Important: the * should be used only as a test, as it'll lead your application to trust the X-Forwarded-* headers from any source. I suggest you read uvicorn's docs and gunicorn's docs for a deeper knowledge of what to set in this flag and why.

I experienced this issue when using FastAPI with react-admin.

One workaround is to change FastAPI app so it doesn't make redirects, but treats both URLs as valid API endpoints (with and without slash).

You can use this snippet wrote by malthunayan to change behaviour of APIRouter:

from typing import Any, Callable

from fastapi import APIRouter as FastAPIRouter
from fastapi.types import DecoratedCallable


class APIRouter(FastAPIRouter):
    def api_route(
        self, path: str, *, include_in_schema: bool = True, **kwargs: Any
    ) -> Callable[[DecoratedCallable], DecoratedCallable]:
        if path.endswith("/"):
            path = path[:-1]

        add_path = super().api_route(
            path, include_in_schema=include_in_schema, **kwargs
        )

        alternate_path = path + "/"
        add_alternate_path = super().api_route(
            alternate_path, include_in_schema=False, **kwargs
        )

        def decorator(func: DecoratedCallable) -> DecoratedCallable:
            add_alternate_path(func)
            return add_path(func)

        return decorator

source: https://github.com/tiangolo/fastapi/issues/2060#issuecomment-834868906

(you can also see other similar solutions in this GitHub issue)

Another workaround is to add:

<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">

to index.html file in frontend. It will upgrade all requests from http to https (also when run locally, so it may not be the best workaround)