0

I just updated my NGINX server on Ubuntu to the latest official version 1.9.15.

Since then a config that I used for quite a while stopped working. In short, I redirect all traffic to https except of one page e.g. /mypage/, which needs to be available via http due to external resources.

This is how my config looks like.

server {

  listen 12.34.56.78:80;

  server_name www.myside.com;
  root /home/myside.com/public_html;
  index index.php;

  location ~ \.php$ {
    include fastcgi.conf;
    fastcgi_intercept_errors on;
    fastcgi_pass php;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
  }

  location / {
    return 301 https://www.myside.com$request_uri;
    try_files $uri $uri/ /index.php?$args;
  }

      # but no redirect for this particular location:
  location /mypage/ {
    try_files $uri $uri/ /index.php?$args;
  }

}

server {

  listen 12.34.56.78:443 ssl http2 default_server;

  ssl on;
  ssl_certificate /etc/nginx/ssl/myside.com/cert.pem;
  ssl_certificate_key /etc/nginx/ssl/myside.com/privkey.pem;

  server_name www.myside.com myside.com;
  root /home/myside.com/public_html;
  index index.php;

  location / {
    try_files $uri $uri/ /index.php?$args;
  }

  location ~ \.php$ {
    include fastcgi.conf;
    fastcgi_intercept_errors on;
    fastcgi_pass php;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
  }

  location /mypage/ {
    return 301 http://$server_name$request_uri;
    try_files $uri $uri/ /index.php?$args;
  }

}

Unfortunately it is now looping http -> https -> http -> https and so on.

4
  • It will probably loop on /mypage. What does the error log show? Apr 24, 2016 at 22:22
  • Unfortunately nothing there. I see the redirect being answered with 200 and so on, at some point the browser just stops.
    – David
    Apr 25, 2016 at 12:49
  • Sorry, I actually meant the access log. But exactly what URL is looping? Apr 25, 2016 at 13:13
  • /mypage/ is looping, means from http -> https -> http -> https an then the browser terminates the session with the remark "too many redirects"
    – David
    Apr 27, 2016 at 7:10

1 Answer 1

0

I finally found the solution. This happened due to Strict-Transport-Security being enabled and the max-age being set to one year.

By changing that line to:

    add_header Strict-Transport-Security "max-age=0; includeSubdomains";

the maximum age is set to 0 which equals disabled.

More on this https://datatracker.ietf.org/doc/html/draft-ietf-websec-strict-transport-sec-11#section-6.1.1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.