Hello Railway Support,

We run a FastAPI application with Uvicorn 0.34.0 behind Railway Public Networking. A POST endpoint requires HTTPS and a dedicated Bearer token.

Railway terminates TLS before forwarding requests to the application. The internal proxy peer IP varies between requests, so allowlisting individual IPs with FORWARDED_ALLOW_IPS is unreliable. When the proxy is not trusted, the application sees request.url.scheme == "http" and rejects the request.

We do not want to trust all IPs, guess a proxy CIDR, or rely solely on client-spoofable Host/forwarded headers. Bearer authentication must remain, but it does not prove that a request passed through the HTTPS proxy.

Could you confirm:

Is there an officially supported configuration that allows only Railway’s Public HTTPS proxy to reach the application’s listening port, blocking direct public and private-network access? If so, what are the exact settings and limitations?

Does Railway provide a verifiable proxy identity mechanism that does not depend on source IPs—for example, proxy-to-application mTLS or cryptographically signed forwarding metadata?

If neither is available, what supported configuration do you recommend for reliably enforcing HTTPS at this endpoint without trusting all proxies or adding another proxy service?

Please include the relevant documentation, whether X-Forwarded-Proto is overwritten or sanitized by the edge, and any plan or runtime requirements.

Thank you.