request.url in route handlers is with https when you are actually running in http. This can happen when you run OpenNext locally or in wrangler dev.
We also have a test for this. It will fail when you run the E2E with local dev overrides. In the Cloudflare adapter they skip these tests for now.
It is correct in the middleware BTW.