--- includes/bootstrap.inc.orig	2009-06-10 16:00:10.000000000 -0400
+++ includes/bootstrap.inc	2009-06-16 15:41:03.000000000 -0400
@@ -475,7 +475,27 @@
   }
   else {
     // Create base URL
-    $base_root = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') ? 'https' : 'http';
+    $base_root = "http"; // default
+    if (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') {
+      // We're running HTTPS natively in the web server.
+      $base_root = 'https';
+    }
+    elseif (file_exists(DRUPAL_ROOT . '/' . conf_path() . '/settings.php')) {
+      // We have a settings.php, so we can look for configuration.
+      if (isset($conf['reverse_proxy']) && $conf['reverse_proxy']) {
+        // Only trust proxy headers if 'reverse_proxy' is configured.
+        if ( (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && strtolower($_SERVER['HTTP_X_FORWARDED_PROTO']) == "https") || (isset($_SERVER['HTTP_FRONT_END_HTTPS']) && $_SERVER['HTTP_FRONT_END_HTTPS'] == 'on') ) {
+          // We appear to be behind a proxy.
+          $base_root = "https";
+        }
+      }
+    }
+    elseif ( (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && strtolower($_SERVER['HTTP_X_FORWARDED_PROTO']) == "https") || (isset($_SERVER['HTTP_FRONT_END_HTTPS']) && $_SERVER['HTTP_FRONT_END_HTTPS'] == 'on') ) {
+      // We have no settings.php to store a value for 'reverse_proxy',
+      // so this is a new installation.  We seem to be behind a proxy,
+      // so we'll trust the header for now.
+      $base_root = "https";
+    }
 
     $base_url = $base_root .= '://' . $_SERVER['HTTP_HOST'];