Nginx + ELB : Redirect all HTTP to HTTPS

Question

Before reading further, I have tried to understand / find a solution. From the similar questions, I did not find my answer or at least understood what I am doing wrong.

So I have 2 instances of Amazon EC2 and a load balancer ELB.

For each instance, I use NGINX with Gunicorn and Django.

I setup a redirection for all HTTP request to HTTPS. But for some unexplained reasons, redirections do not work.

I tried to change my hosts file so I can connect directly to one of the instance and the redirection works. But When I use the ELB, it does not work.

Here is an example of nginx configuration :

upstream myserver {
    server 127.0.0.1:10032 fail_timeout=0;
}

server {
    listen                      80;
    server_name                 pub.myserver.ca;
    return                      301 https://$server_name$request_uri;
}

server {
    listen                      443;
    server_name                 pub.myserver.ca;
    ssl                         on;
    ssl_certificate             /etc/ssl/pub_myserver_ca.pem;
    ssl_certificate_key         /etc/ssl/pub_myserver_ca.key;
    ssl_protocols               TLSv1.2 TLSv1.1 TLSv1;
    access_log                  /var/log/nginx/myserver-access.log;
    error_log                   /var/log/nginx/myserver-error.log;

    keepalive_timeout           300;
    proxy_read_timeout          300;
    client_max_body_size        200M;

    location / {
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_redirect off;

        if (!-f $request_filename) {
            proxy_pass http://myserver;
            break;
        }
    }

    location /static {
        autoindex off;
        alias /home/tool/www/static;
    }
}

Do you have any ideas? Or insight? Or documentation that I should look into?

Thank you in advance.

EDIT

cUrl response when request goes through the ELB :

$ curl -I http://pub.myserver.ca/client/sign-in/

HTTP/1.1 200 OK
Content-Language: en
Content-Type: text/html; charset=utf-8
Date: Tue, 23 May 2017 20:39:34 GMT
Server: nginx
Set-Cookie: csrftoken=********; expires=Tue, 22-May-2018 20:39:34 GMT; Max-Age=31449600; Path=/
Set-Cookie: sessionid=********; expires=Tue, 06-Jun-2017 20:39:34 GMT; httponly; Max-Age=1209600; Path=/
Vary: Accept-Language, Cookie
X-Frame-Options: SAMEORIGIN
Connection: keep-alive

cUrl response when request goes directly to the server :

$ curl -I http://pub.myserver.ca/client/sign-in/

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Tue, 23 May 2017 20:40:18 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://pub.myserver.ca/client/sign-in/

ELB Configuration:

ELB Listener

Answer 1

Your ELB is set-up to accept requests from the client on http or https, but pass the requests all to the instances over https. This is why requests via the ELB don't get a 301 redirect, the ELB has effectively already done it for you.

When you make an http request to the instance directly there's no ELB, so you do get the 301 redirect.

I suspect the cookies are added by the application, rather than the ELB. If you make an https request directly to the instance you can confirm this. I believe the "httponly" part is because Nginx is proxing an https request to an http server, which isn't aware of the proxy. You may want to configure your application to generate https links. You may be able to use X-Forwarded-Proto and similar headers to help with this.

You haven't said what problem this is causing. Is this causing a problem, or are you simply wanting to understand the system behavior? If this doesn't solve your problem, please edit your question to clearly state the business or technical problem this is causing, then comment on the answer.

Answer 2

Thanks to @Michael-sqlbot who helped me to fix my problem which was to redirect users from HTTP to HTTPS.

The solution was to change the listener in ELB config: I replaced 80 >> 443 by 80 >> 80

Also thank you to @Tim who took time to help me.