0

Before reading further, I have tried to understand / find a solution. From the similar questions, I did not find my answer or at least understood what I am doing wrong.

So I have 2 instances of Amazon EC2 and a load balancer ELB.

For each instance, I use NGINX with Gunicorn and Django.

I setup a redirection for all HTTP request to HTTPS. But for some unexplained reasons, redirections do not work.

I tried to change my hosts file so I can connect directly to one of the instance and the redirection works. But When I use the ELB, it does not work.

Here is an example of nginx configuration :

upstream myserver {
    server 127.0.0.1:10032 fail_timeout=0;
}

server {
    listen                      80;
    server_name                 pub.myserver.ca;
    return                      301 https://$server_name$request_uri;
}

server {
    listen                      443;
    server_name                 pub.myserver.ca;
    ssl                         on;
    ssl_certificate             /etc/ssl/pub_myserver_ca.pem;
    ssl_certificate_key         /etc/ssl/pub_myserver_ca.key;
    ssl_protocols               TLSv1.2 TLSv1.1 TLSv1;
    access_log                  /var/log/nginx/myserver-access.log;
    error_log                   /var/log/nginx/myserver-error.log;

    keepalive_timeout           300;
    proxy_read_timeout          300;
    client_max_body_size        200M;

    location / {
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_redirect off;

        if (!-f $request_filename) {
            proxy_pass http://myserver;
            break;
        }
    }

    location /static {
        autoindex off;
        alias /home/tool/www/static;
    }
}

Do you have any ideas? Or insight? Or documentation that I should look into?

Thank you in advance.

EDIT

cUrl response when request goes through the ELB :

$ curl -I http://pub.myserver.ca/client/sign-in/

HTTP/1.1 200 OK
Content-Language: en
Content-Type: text/html; charset=utf-8
Date: Tue, 23 May 2017 20:39:34 GMT
Server: nginx
Set-Cookie: csrftoken=********; expires=Tue, 22-May-2018 20:39:34 GMT; Max-Age=31449600; Path=/
Set-Cookie: sessionid=********; expires=Tue, 06-Jun-2017 20:39:34 GMT; httponly; Max-Age=1209600; Path=/
Vary: Accept-Language, Cookie
X-Frame-Options: SAMEORIGIN
Connection: keep-alive

cUrl response when request goes directly to the server :

$ curl -I http://pub.myserver.ca/client/sign-in/

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Tue, 23 May 2017 20:40:18 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://pub.myserver.ca/client/sign-in/

ELB Configuration:ELB Configuration

ELB Listener

  • Can you please edit your question to demonstrate the problem with curls (showing only response headers), both from the instance (with hosts file mapping to the internal IP) and from an external machine where it's going via the ELB. It might be worth posting the ELB configuration, the part around http/https. – Tim May 23 '17 at 18:59
  • Hello @Tim, I have edited the question as per requested. – Kornikopic May 23 '17 at 20:47
  • Great. Please make sure you label the curls properly - direct and via ELB. Also you missed adding screenshot of ELB configuration. I'd also like to see the access and error log entries associated with each curl. I wonder why the sessionid cookies is marked httponly - is that coming from elb or your application? If it's coming from your application why is it marked http only when the application appears to be on https? Is the application aware it's running on https? – Tim May 23 '17 at 20:49
  • The most likely situation here is that you have wired up the ELB to listen on port 80 but forward that traffic to the instance on port 443, instead of 80 >> 80 and 443 >> 443, you have configured the ELB for 80 >> 443 and 443 >> 443. That would perfectly explain it. – Michael - sqlbot May 23 '17 at 23:31
  • @Tim I attached a copy of the ELB configuration. About the httponly, I have no idea where does it come from. I think it's the ELB (but not sure). Could it be CloudFlare? The application handle the requests from http and https, so I know it's not from this part. – Kornikopic May 24 '17 at 12:02
0

Your ELB is set-up to accept requests from the client on http or https, but pass the requests all to the instances over https. This is why requests via the ELB don't get a 301 redirect, the ELB has effectively already done it for you.

When you make an http request to the instance directly there's no ELB, so you do get the 301 redirect.

I suspect the cookies are added by the application, rather than the ELB. If you make an https request directly to the instance you can confirm this. I believe the "httponly" part is because Nginx is proxing an https request to an http server, which isn't aware of the proxy. You may want to configure your application to generate https links. You may be able to use X-Forwarded-Proto and similar headers to help with this.

You haven't said what problem this is causing. Is this causing a problem, or are you simply wanting to understand the system behavior? If this doesn't solve your problem, please edit your question to clearly state the business or technical problem this is causing, then comment on the answer.

0

Thanks to @Michael-sqlbot who helped me to fix my problem which was to redirect users from HTTP to HTTPS.

The solution was to change the listener in ELB config: I replaced 80 >> 443 by 80 >> 80

Also thank you to @Tim who took time to help me.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.