Commerce Manager over HTTPS with load balancer

Commerce Manager - either you like it or hate it - is still an important part of Commerce, and there are functionalities which can't be found else where, so you will have to stick with it for the time being. And as it's important enough, it's a recommended practice to secure the site with HTTP over SSL - aka HTTPS (Along with other security measures such as put it behind a firewall or limit access to trusted IP only, etc.). However, it might be a problem if you want to put it behind some load balancer. This kind of message can be seen in such scenario (via browser console):

default.aspx:1 Mixed Content: The page at 'https://commercemanager.com/Apps/Shell/Pages/default.aspx' was loaded over HTTPS, but requested an insecure script 'http://commercemanager.com/Apps/Shell/Scripts/Shell/mainLeftTemplate.js?v=10.7.3.0'. This request has been blocked; the content must be served over HTTPS.

Due to your browser configuration, you might not access the site because it blocks the mixed content. While HTTPS is great, mixed content can open doors for attacks like Man in the middle and it's best that browsers disable that by default.

But that can be solved, easily enough, if you:

• Upgrade your site to at least Commerce 10.6.0, to have this bug https://world.episerver.com/documentation/Release-Notes/ReleaseNote/?releaseNoteId=COM-4220 fixed
• Configure the header X-Forwarded-Proto to "https" on your load balancer. Because most of the load balancers will redirect to non-HTTPS requests before they reach to ASP.NET (in this case, Commerce Manager), then we need a way to know that the request was on HTTPS or not, to load the assets correctly.

And now your Commerce Manager will be happily working over HTTPS, behind a load balancer.