0

In this question: rewrite http to https with ngnix behind load balancer

the question is how to force SSL for nginx servers behind a loadbalancer. The problem with this setup is that the loadbalancer handles SSL and has a non SSL connection with the webservers/nodes.

So it looks at the http-x-forwarded-proto header. The accepted answer works fine except that it uses an if like so:

if ($http_x_forwarded_proto = "http") {
            rewrite  ^/(.*)$  https://mydomain.com/$1 permanent;
}

which is evil: http://wiki.nginx.org/IfIsEvil

Is there a better way to do this without an if?

One possible solution would be to force ssl at the loadbalancer, but this loadbalancer is managed by our hoster, which makes changes more tedious, im hoping for an answer which doesn require changes to the loadbalancer

Improve this question

1 Answer 1

Reset to default
1

Since you have nginx behind an SSL-terminating load balancer, I don't think it will be easy for you to avoid using if. But not all is lost.

To be "not evil" you can replace rewrite permanent with return, one of the safe things you can do with if.

    return 301 https://$http_host$request_uri;

This will simply reconstruct the URL with https, and everything else exactly as given.

Improve this answer
5
  • $request_uri already contains arguments.
    – Alexey Ten
    Jul 7, 2014 at 13:42
  • 1
    Also HSTS could add some benefits.
    – Alexey Ten
    Jul 7, 2014 at 13:42
  • If so, then I suppose you can just omit the "second" args.
    – Michael Hampton
    Jul 7, 2014 at 13:55
  • @AlexeyTen but with HSTS nginx would still run the if logic I guess?
    – Richard Deurwaarder
    Jul 9, 2014 at 7:39
  • Yes. HSTS just forces use of https for clients that use it. So it will reduce number of redirects from http to https.
    – Alexey Ten
    Jul 9, 2014 at 7:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .