2

I try to reddirect all my traffic on https. I use AWS, passenger + NGINX .

So far with my smartphone ( android ) , chrome last version : http://server_name.com redirect to https...

at home on my computer chrome last version reddirect aswell. But on others computer, it doesn't reddirect.

Of course everywhere https://server_name.com works when dirrectly accessed.

here is my conf :

#user  adrien;

events {
    worker_connections 768;
    # multi_accept on;
}

http {
  passenger_root /home/ubuntu/.rvm/gems/ruby-2.3.1/gems/passenger-5.0.30;
  passenger_ruby /home/ubuntu/.rvm/gems/ruby-2.3.1/wrappers/ruby;

  server_tokens off;
  add_header X-Frame-Options SAMEORIGIN;
  add_header X-Content-Type-Options nosniff;
  add_header X-XSS-Protection "1; mode=block";
  add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://bam.nr-data.net https://js-agent.newrelic.com 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://secure.gravatar.com https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";

  ssl_session_cache shared:ssl_session_cache:10m;

  server {
    listen      80 default_server;
    server_name xeralis.eu www.xeralis.eu;
    return      301 https://$host$request_uri;
  }

  server {
    listen 443;
    server_name xeralis.eu www.xeralis.eu;

    ssl on;
    ssl_session_timeout 5m;
    ssl_certificate /etc/ssl/nginx.crt;
    ssl_certificate_key /etc/ssl/nginx.key;

    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
    ssl_prefer_server_ciphers   on;
    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
    ssl_dhparam /etc/ssl/dhparams.pem;

    resolver 8.8.8.8;
    # Rails add its own headers with force_ssl: true
    # add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    passenger_enabled on;
    passenger_friendly_error_pages on;
    rails_env development;
        root   /home/ubuntu/www/rails/mercipublic/public;

    location /cable {
        passenger_app_group_name gorails_websocket;
        passenger_force_max_concurrent_requests_per_process 0;
    }

    location ~* ^/assets/ {
        gzip_static on;
        expires max;
        add_header Cache-Control public;
    }

    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
      root html;
    }

    keepalive_timeout 10;
    }
}

This conf gives me a mark of 'A' on SSL labs. what could i do to make my website work from everywhere, http always reddirecting to HTTPS

**Edit Headers in response for http **

Demonstration:
Warning: Setting custom HTTP method to HEAD with -X/--request may not work the Warning: way you want.
Consider using -I/--head instead.
curl: (7) Failed to connect to xeralis.eu port 80: Connection refused

with -I:
Failed to connect to xeralis.eu port 80: Connection refused

**Edit Headers in response for https **

Warning: Setting custom HTTP method to HEAD with -X/--request may not
work the Warning: way you want. Consider using -I/--head instead.
HTTP/1.1 200
OK Date: Tue, 28 Feb 2017 22:36:59 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 11339 Connection: keep-alive
Set-Cookie: AWSALB=1AbTZpK/eslWt+5VDBK1wqKygcY30U73T36e8987HvJVTR2iE4jqD2W51m+pwEvvzd+Y9wazTTG1rrh2T0BNsNE+TDB9mD5Bl1EADEFWL9hxlHQsqOuQ6/p6qXjy; Expires=Tue, 07 Mar 2017 22:36:59 GMT; Path=/
Status: 200 OK
Cache-Control: max-age=0, private, must-revalidate
ETag: W/"4b9c4360372ca37d2116059c2018043b"
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Runtime: 0.081279
X-Request-Id: 288d1d28-b6ae-420f-9c87-9e016873c900 Set-Cookie: _mercipublic_session=aEdtcW9NRFlQSytSL1VFTmFoVlNHd0RCUXk1ZzFCaFo3ak5RUGQ0SmRocC9MVmxmd0VnNWxZem5sUDlySTUxVDlDVGFIZTRBbVFwRGwvOXpSNmhReTh6Z2d4MkpVQWhVL2Z6bGJ3UWt3U3BqRXNsMjZSUnNXOW55OEtOTk9GUzdzbERnSWJXR3c2Y2F1dUF2RmRNWlhBPT0tLWUyYWl5aWlsT3lUS2s2YXkya0JJNVE9PQ%3D%3D--e896f790c978b429d6644055f2e8c827d07657c2; path=/; HttpOnly
X-Powered-By: Phusion Passenger 5.0.30
Server: nginx + Phusion Passenger 5.0.30
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src 'self'; script-src 'self' https://bam.nr-data.net https://js-agent.newrelic.com 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://secure.gravatar.com https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'

** EDIT 2 half problem solved ** The problem was coming from the ELB of AWS. I had only one listener on 443. So of course it was blocking the 80...

Now the only last thing i have to solve is why the redirection isn't working while both HTTP and HTTPS works

5
  • If my suggestion on how to get request / response headers below didn't work on your OS you can use Google to find the correct flags or an alternative method. One is using the "Live HTTP Headers" extension with Firefox. If you want that level of support you can hire a consultant or pay for support.
    – Tim
    Feb 28, 2017 at 22:39
  • Response headers aren't very useful without the curl command and request headers and the context - ie was this sucess or failure. 200 ok suggests it's worked fine, which doesn't match with your question. If you really want help with this problem you need to proactively give people the information they need, rather than giving the minimum possible.
    – Tim
    Feb 28, 2017 at 23:12
  • 200 is for https as i said, this is the only time when it works. i don't understand why 80 refuse connexion
    – Chim
    Mar 1, 2017 at 16:32
  • Config looks fine, probably another configuration error. You need to show redirection not working with curl, giving us the curl command line, request header, and response header, ideally both one working and one not.
    – Tim
    Mar 1, 2017 at 17:59
  • i have no redirection working at all
    – Chim
    Mar 3, 2017 at 11:33

1 Answer 1

0

Try this alternate block, which removes $host and hard codes the URL to redirect to. The reason I suggest you try this is the definition of $host

in this order of precedence: host name from the request line, or host name from the “Host” request header field, or the server name matching a request

server {
    listen      80 default_server;
    server_name xeralis.eu www.xeralis.eu;
    return      301 https://www.xeralis.eu$request_uri;
}

If that doesn't work please edit your question to include demonstrations of what happens, both when it's successful and when it fails. "curl -X HEAD -i (URL)" usually does it. Show the matching access log entries as well.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .