Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using NGINX as a web server. I would like to use https just in my login page, all other pages should serve http connection. How is possible to redirect the user to https when he types "/login" url prefix and then redirect to "http" when he types any other url suffix?

Thanks

share|improve this question
2  
Are you certain you only want to encrypt the login? The session cookie being sent with non-encrypted requests will be easily grabbed; if the session is sensitive, encrypt everything. –  Shane Madden Apr 17 '13 at 2:07
    
Hello Shane. Yes, I just would like that the password wont be sniffed. I don't have any other sensitive information. –  Thomas Apr 17 '13 at 11:35
    
Right, but is it a problem if someone is able to get logged into the application as if they had entered the password, without entering a password at all? –  Shane Madden Apr 17 '13 at 20:30
    
Hello Shane, yes user should just use the login/password in a https. In this moment I am not worrying about cookies or session that can be sniffed. So the idea i just to have https on /login url and than force http to any other url –  Thomas Apr 17 '13 at 22:25

1 Answer 1

for example, like this

server {
    listen *:80;

    ...

    location /login {
        return 301 https://$server_name$request_uri;
    }

    ...
}

server {
    listen *:443;
    ...
    location /login {
        # usual settings, proxy_pass etc...
    }

    location / {
        return 301 http://$server_name$request_uri;
    }
}
share|improve this answer
    
Hello Cadmi, and how is possible to return to "http" when the user visits any other page? –  Thomas Apr 17 '13 at 11:35
    
what a stupid question? listen *:80 will be http return on all pages, but /login (which forced redirect to https). do you want force redirect from https:// site (listen *:443) to http (listen *:80) for all pages, but /login? –  cadmi Apr 17 '13 at 11:45
    
Yes Cadmi. After login I would like to redirect to http. Is it possible? –  Thomas Apr 17 '13 at 17:27
    
@Thomas, see update of my answer, redirect in listen *:443 section –  cadmi Apr 18 '13 at 13:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.