Redirect http to https using Application Load Balancer

Question

I am using an application load balancer to map certain paths to one server (Apache) and other paths to another server (Tomcat).

I made all pages on my site available via https by setting up an https listener on the load balancer.

So that requests from client to load balancer are encrypted but from load balancer to servers are not.

Now, I would also like to redirect all http requests to https.

Are there any suggestions how I can do this?

I can redirect each server separately (ie: redirect tomcat http requests as outlined here and redirect Apache http request with redirect rules). However, I was wondering if there is a simpler way to do it (ie: where I would only have 1 redirect rather than a separate redirect for each server).

Thanks.

Have you looked into implementing HSTS? en.wikipedia.org/wiki/HTTP_Strict_Transport_Security — mikwat
Thanks. I did not know much about HSTS, but as I understand it, even if I do implement HSTS I would need to do so in addition to redirects (not instead of)...Therefore my question still stands. — theyuv
The load balancer isn't capable of issuing redirects. You have to configure your web servers to check the x-forwarded-proto value and issue the appropriate redirect. — Mark B
Thanks @MarkB, is there some documentation for how best to do this for Tomcat? — theyuv
Here lies the answer to your struggle: stackoverflow.com/a/51540255/9180019 — the0ffh

Laurence Laurence · Accepted Answer · 2018-02-23T10:20:00

I found this while I was looking for a solution for the same problem. This has code sample for Apache, Nginx and IIS.

<VirtualHost *:80>

RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} =http
RewriteRule .* https://%{HTTP:Host}%{REQUEST_URI} [L,R=permanent]

</VirtualHost>

https://aws.amazon.com/premiumsupport/knowledge-center/redirect-http-https-elb/

Redirect http to https using Application Load Balancer

1 Answers