If you’re using Strapi Community Edition and suddenly run into an “Internal Server Error” when logging into the Strapi admin panel, you’re dealing with a common issue that happens when Strapi is deployed behind a proxy, load balancer, or SSL-terminating service.
Many developers report that everything in Strapi works perfectly — APIs, content types, the frontend — except for one thing:
You cannot log in to the Strapi admin dashboard.
Click “Log In,” and Strapi throws a 500 Internal Server Error.
This login failure typically has nothing to do with your credentials or your database. Instead, it’s caused by how Strapi detects (or fails to detect) whether the incoming request is secure (HTTPS).
Below is the complete explanation and the official fix.
When Strapi is running behind any kind of reverse proxy, CDN, or load balancer — such as:
— the HTTPS connection is usually terminated before reaching the Strapi Node server.
Even though your site is truly secure, Strapi can fail to detect that the original request was encrypted. This causes Strapi to treat the login attempt as insecure, which breaks the authentication flow and triggers the 500 Internal Server Error on login.
The issue is documented in the official GitHub tracker and confirmed by the Strapi team.
The fix is simple:
You need to add a middleware that forces Strapi to treat the request as encrypted.
Add the following to your src/index.ts or src/index.js:
export default {
register({ strapi }) {
// Force the socket to be treated as encrypted for proxy setups
strapi.server.use(async (ctx, next) => {
if (ctx.req?.socket) {
(ctx.req.socket as any).encrypted = true;
}
await next();
});
},
bootstrap() {},
};
Then restart your Strapi server.
As soon as this middleware is active, the admin login will work correctly again — no more 500 errors.
This solution applies if:
If you’re using Strapi’s built-in HTTPS support directly (less common), you may not need this.
This is the exact fix recommended by the Strapi maintainers in the GitHub discussion:
https://github.com/strapi/strapi/issues/24535
The middleware forces the socket to be treated as HTTPS, ensuring the admin authentication flow works correctly in proxy-based environments.
