3

I have a basic ASP.NET application that sits behind an F5 load-balancer.

Incoming SSL requests (over HTTPS) terminate at the load-balancer and all internal communication between the load-balancer and my application servers is unsecure (over HTTP).

When a unsecure request comes in, my app is able to use Response.Redirect("https://...") to redirect a secure URL with no problems. However, the other direction appears to be impossible - I cannot redirect from HTTPS to HTTP using Response.Redirect() from my application. The URL remains HTTPS for the client and does not change. Could the F5 be preventing the redirect for ever reaching the client?

Is there any special configuration necessary to let this happen?

Improve this question

2 Answers 2

Reset to default
4

Yes, the F5 may be intercepting and rewriting the redirect to be HTTPS.

Find the HTTP Profile that is associated with your Virtual Server. What is "Rewrite Redirects" set to? Since you're the developer of the app, you probably want None. (Remember to make a new HTTP profile for your app rather than edit the default one.)

This option is designed to handle redirects from applications that aren't really SSL Offload aware.

There's a good article about this option on DevCentral.

On a related note, why are you redirecting back to HTTP? If your BIG-IP is hardware (not Virtual Edition) then it probably handles 500-2000 SSL TPS depending on licensed modules. What is your traffic load? I'm guessing you're unlikely to be establishing over 500 new SSL connections per second. It could be easier and more secure to keep everything on HTTPS.

Improve this answer
1
  • Also note that if asp.net web app is bound to http instead of https using stuff like Response.Redirect("~/folder/page.aspx") will cause IIS to send 302 redirect as http instead of https. For reason that you stated: IIS is not aware of SSL offloading; it thinks it is HTTP and so it acts like it is HTTP, like it should. This is issue to be fixed in F5 configuration.
    – nothingisnecessary
    Jun 27, 2016 at 15:58
0

Not sure if there is an F5 issue here but you may want to look into using the IIS Rewrite module instead of the standard Response... Object. Has a lot more options and capabilities and might even be able to handle the problem you're having.

http://www.iis.net/download/URLRewrite

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .