Excluding one URL from being redirected to HTTPS generates a loop with current NGINX version

Question

I just updated my NGINX server on Ubuntu to the latest official version 1.9.15.

Since then a config that I used for quite a while stopped working. In short, I redirect all traffic to https except of one page e.g. /mypage/, which needs to be available via http due to external resources.

This is how my config looks like.

server {

  listen 12.34.56.78:80;

  server_name www.myside.com;
  root /home/myside.com/public_html;
  index index.php;

  location ~ \.php$ {
    include fastcgi.conf;
    fastcgi_intercept_errors on;
    fastcgi_pass php;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
  }

  location / {
    return 301 https://www.myside.com$request_uri;
    try_files $uri $uri/ /index.php?$args;
  }

      # but no redirect for this particular location:
  location /mypage/ {
    try_files $uri $uri/ /index.php?$args;
  }

}

server {

  listen 12.34.56.78:443 ssl http2 default_server;

  ssl on;
  ssl_certificate /etc/nginx/ssl/myside.com/cert.pem;
  ssl_certificate_key /etc/nginx/ssl/myside.com/privkey.pem;

  server_name www.myside.com myside.com;
  root /home/myside.com/public_html;
  index index.php;

  location / {
    try_files $uri $uri/ /index.php?$args;
  }

  location ~ \.php$ {
    include fastcgi.conf;
    fastcgi_intercept_errors on;
    fastcgi_pass php;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
  }

  location /mypage/ {
    return 301 http://$server_name$request_uri;
    try_files $uri $uri/ /index.php?$args;
  }

}

Unfortunately it is now looping http -> https -> http -> https and so on.

Answer 1

I finally found the solution. This happened due to Strict-Transport-Security being enabled and the max-age being set to one year.

By changing that line to:

    add_header Strict-Transport-Security "max-age=0; includeSubdomains";

the maximum age is set to 0 which equals disabled.

More on this https://datatracker.ietf.org/doc/html/draft-ietf-websec-strict-transport-sec-11#section-6.1.1