Sometimes we can find a site with SSL in which we have a reverse proxy that acts as an SSL terminator. Behind that reverse proxy, you have a web server.
Within the application it uses a 302 redirect to announce new URLs. Since the web server does not know that URLs have to be advertised using https, the response header is incorrect.
To solve this problem we have to add the following configuration:
text
location / {
add_header Front-End-Https on;
add_header Cache-Control «public, must-revalidate»;
add_header Strict-Transport-Security «max-age=2592000; includeSubdomains»;
proxy_pass http://backend_servers_mrg;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_redirect http:// https://;
}Below is an example which performs a reverse proxy to a tomcat server and the application uses 302 redirects to announce the new URLs:
nginx
upstream backend_servers {
least_conn;
server 192.168.1.90 max_fails=1 fail_timeout=5s;
server 192.168.1.91 max_fails=1 fail_timeout=5s;
}
server {
listen 80;
server_name red-orbita.com;
location / {
add_header Front-End-Https on;
add_header Cache-Control «public, must-revalidate»;
add_header Strict-Transport-Security «max-age=2592000; includeSubdomains»;
proxy_pass http://backend_servers_mrg;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log /var/log/nginx/proxy.access.log;
error_log /var/log/nginx/proxy.error.log;
}
}
server {
listen 443 ssl;
server_name red-orbita.com;
#limit_conn conn_limit_per_ip 50;
#limit_req zone=req_limit_per_ip burst=50 nodelay;
access_log /var/log/nginx/redorbita.access.log;
error_log /var/log/nginx/redorbita.error.log;
index index.html index.htm;
ssl on;
ssl_certificate /etc/nginx/ssl/redorbita.es-cert.pem;
ssl_certificate_key /etc/nginx/ssl/redorbita.es-privatekey.key;
keepalive_timeout 60;
ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP;
ssl_protocols SSLv3 TLSv1;
ssl_prefer_server_ciphers on;
ssl_verify_client off;
proxy_buffers 16 64k;
proxy_buffer_size 128k;
location / {
add_header Front-End-Https on;
add_header Cache-Control «public, must-revalidate»;
add_header Strict-Transport-Security «max-age=2592000; includeSubdomains»;
proxy_pass http://backend_servers_mrg;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_redirect http:// https://;
}:wq!
Comments