0

I just updated my NGINX server on Ubuntu to the latest official version 1.9.15.

Since then a config that I used for quite a while stopped working. In short, I redirect all traffic to https except of one page e.g. /mypage/, which needs to be available via http due to external resources.

This is how my config looks like. 

server {

  listen 12.34.56.78:80;

  server_name www.myside.com;
  root /home/myside.com/public_html;
  index index.php;

  location ~ \.php$ {
    include fastcgi.conf;
    fastcgi_intercept_errors on;
    fastcgi_pass php;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
  }

  location / {
    return 301 https://www.myside.com$request_uri;
    try_files $uri $uri/ /index.php?$args;
  }

      # but no redirect for this particular location:
  location /mypage/ {
    try_files $uri $uri/ /index.php?$args;
  }

}

server {

  listen 12.34.56.78:443 ssl http2 default_server;

  ssl on;
  ssl_certificate /etc/nginx/ssl/myside.com/cert.pem;
  ssl_certificate_key /etc/nginx/ssl/myside.com/privkey.pem;

  server_name www.myside.com myside.com;
  root /home/myside.com/public_html;
  index index.php;

  location / {
    try_files $uri $uri/ /index.php?$args;
  }

  location ~ \.php$ {
    include fastcgi.conf;
    fastcgi_intercept_errors on;
    fastcgi_pass php;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
  }

  location /mypage/ {
    return 301 http://$server_name$request_uri;
    try_files $uri $uri/ /index.php?$args;
  }

}

Unfortunately it is now looping http -> https -> http -> https and so on.

|improve this question
  • It will probably loop on /mypage. What does the error log show? – Richard Smith Apr 24 '16 at 22:22
  • Unfortunately nothing there. I see the redirect being answered with 200 and so on, at some point the browser just stops. – David Apr 25 '16 at 12:49
  • Sorry, I actually meant the access log. But exactly what URL is looping? – Richard Smith Apr 25 '16 at 13:13
  • /mypage/ is looping, means from http -> https -> http -> https an then the browser terminates the session with the remark "too many redirects" – David Apr 27 '16 at 7:10
0

I finally found the solution. This happened due to Strict-Transport-Security being enabled and the max-age being set to one year.

By changing that line to:

    add_header Strict-Transport-Security "max-age=0; includeSubdomains";

the maximum age is set to 0 which equals disabled.

More on this http://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec-11#section-6.1.1

|improve this answer

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.