1

We are implementing a redirect rule to force our traffic to SSL. I was wondering what the most optimal way to force all traffic to SSL was? Our architecture has a CDN(Akamai), that is front of an ELB, that is in front of our web application server(tomcat).

4

Do it in Akamai. The closer to the edge your redirect takes place, the faster the request response time will be for your users.

https://blogs.akamai.com/2016/02/redirecting-on-the-edge.html

If you're confident that you can serve your entire domain over HTTPS now and into the future then you should also look into enabling HSTS. This will mean only first time visitors ever get the HTTP->HTTPS redirect, then the HSTS header gets cached in the browser and thereafter all requests are automatically upgraded to HTTPS by the browser before the request is initiated.

https://blogs.akamai.com/2016/04/ensure-secure-browsing-with-HTTP-strict-transport-security-HSTS.html

https://jackiechen.org/2017/11/13/enable-hsts-in-akamai/

  • 3
    +1... Its also generally easier to secure and config. means you only need to open port 443 to the internet on your firewalls and less config on your box. I've also seen way too many cases of people not securing the port 80 redirect site properly and HTTPS content actually being accessible via HTTP if you hit pages other than index. – Nath Dec 9 '17 at 12:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.