0

I have nginx frontend and tomcat backend. Now I need to encryt the specific url end with .do from client to nginx server using ssl. And js/css could be requsted with http. In order to avoid mixed content with http resource when request https, I also set .jsp without https.

This's my main nginx.conf:

server {
    listen       80;
    server_name  localhost;
    ...
    location / {
        root  /apps/oa/oaapp/OA1;
        index  index.jsp index.html;
    }
    location ~ .*\.do$ {
        rewrite ^(.*)$ https://ittest.example.com$1 permanent;
    }
}

server {
    listen 443;
    server_name ittest.example.com;

    ssl on;
    ...

location / {
    proxy_set_header Host $host:$server_port;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass http://localhost:8080/;
} 

But the problem occurs when I login via http://ittest.example.com/login.html. The page send username and password to http://ittest.example.com/member/login.do to handle the request. My rewrite rule redirect it to https:/ittest.example.com/member/login.do(ssl encrytion).

But I see the request method is changed from POST to GET and with Chrome Development Tool I see no username/password send to server. So fail!

What shoud I do to make it right?

5
  • Why not just move everything from http to https.
    – AD7six
    May 27, 2015 at 8:10
  • Also The page send username and password to http://ittest.example.com/member/login.do If your form submits to http - there is absolutely no point redirecting to https, the password has already been transfered in plain text - submit to the right place.
    – AD7six
    May 27, 2015 at 8:20
  • @AD7six moving all resource from http to https makes users feel the site slows down.
    – seanlook
    May 27, 2015 at 9:04
  • @SeanChow The speed does not really matter.
    – sebix
    May 27, 2015 at 9:42
  • After permanent redirect (301) browsers send GET request instead of original POST. Anyway you should never send login/password via http.
    – Alexey Ten
    May 27, 2015 at 10:01

1 Answer 1

0

You really should redirect to ssl BEFORE the POST. That's the whole point of having ssl there in the first place. Otherwise users are posting their credentials unencrypted!

Theoretically instead of the 302 redirect to https, you could serve a 200 OK with some dummy javascript that does a hidden submit onload to repost the form to https, but REALLY TRULY your best solution here is to redirect http://ittest.example.com/login.html to https://ittest.example.com/login.html. You don't want the credentials EVER to be transmitted over http.

2
  • So you mean, I shoud configurate the the whole page host/login.html ssl encryted, including js/png resource inside the page, not just for one of its request like member/login.do. Right?
    – seanlook
    May 28, 2015 at 3:09
  • 1
    Yes, precisely.
    – jhenn
    May 28, 2015 at 3:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .