Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any standard http header which a ssl termination point should set?
I'm asking because currently we have a loadbalancer which is the termination for https. Behind there's an application server, and at the moment we have no clue wether the request came over http or https.
Should the loadbalancer set a cookie, or maybe a special http header?

share|improve this question
up vote 1 down vote accepted

I assume your load balancer can manipulate the HTTP headers after decipher the SSL. Thus, a solution would be to add a custom local header to the HTTP request forwarded to the server, such as X-SSL-ENABLE: 1.

A cookie would be stored on the client's side, resent for each request and therefore loading your external bandwidth for no reason, since this is of internal use only.

share|improve this answer
Ok, a custom http header. But there is no standard, how this header should be named? Maybe X-HTTPS: on – wittwerch Sep 7 '10 at 9:59
I am not aware of any standard/good practice.I'd say, make it explicit and it should be alright. – Julien Vehent Sep 7 '10 at 10:10
-1: cookie? What cookie? Are you talking abut implementing server affinity on the load balancer? – symcbean Sep 7 '10 at 12:02

SSL wraps HTTP, it is an issue similar to the https Vhost one ... nothing in the http is aware of the encrypted tunnel it is wrapped in.

Nevertheless the web server can set some env variable or other similar mechanism to make server side applications such as php script aware of the channel being encrypted or not, but it is not a protocol issue.

share|improve this answer
Load balancers and application servers rarely share variable (this is different than apache executing php in its own memory context), therefore the HTTP connection is the only way of exchanging information. This is why most infrastructure use X-custom headers in HTTP requests. – Julien Vehent Sep 7 '10 at 9:25
Of course, but the point is that those informations are inside the encrypted channel and are only accessible once the SSL connection is established. Nevertheless What you say is right – drAlberT Sep 8 '10 at 7:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.