53

I use reverse proxy with Nginx and I want to force the request into HTTPS, so if a user wants to access the url with http, he will be automatically redirected to HTTPS.

I'm also using a non-standard port.

Here is my nginx reverse proxy config:

server {
    listen 8001  ssl;
    ssl_certificate /home/xxx/server.crt;
    ssl_certificate_key /home/xxx/server.key;
    location / {
        proxy_pass https://localhost:8000;
        proxy_redirect off;
        proxy_set_header Host $host:$server_port;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Ssl on;
        proxy_set_header  X-Forwarded-Proto  https;
    }
}

I've tried many things and also read posts about it, including this serverfault question, but nothing has worked so far.

2
  • To reopen reviewers: This question is definitely related to programming, and very specific. Just that the 'non-standard port' was not mentioned before, which might have made it a little vague before.
    – bool.dev
    Feb 5, 2014 at 14:54
  • 3
    It's downright wrong that this was closed as off topic. nginx is a common tool used in programming, and the highest rated solution present the correct code to fix the problem: error_page 497 https://$host:$server_port$request_uri; Jun 25, 2014 at 20:15

4 Answers 4

114

Found something that is working well :

server {
        listen 8001  ssl;
        ssl_certificate /home/xxx/server.crt;
        ssl_certificate_key /home/xxx/server.key;
        error_page 497 301 =307 https://$host:$server_port$request_uri;
        location /{
            proxy_pass http://localhost:8000;
            proxy_redirect off;
            proxy_set_header Host $host:$server_port;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Ssl on;
        }
}
5
  • 15
    error code 497 is created especially for this use case [redirect on the same port from http to https]. I think this is the best answer. wiki.nginx.org/HttpSslModule#Nonstandard_error_codes
    – Chuan Ma
    Mar 15, 2013 at 15:23
  • 2
    Thanks a lot!! error_page 497 https://$host:$server_port$request_uri; did the trick!
    – Adrian
    Nov 6, 2014 at 20:41
  • 6
    I would consider adding: error_page 497 301 =307 https://$host:$server_port$request_uri; That way the request method isn't auto converted to a GET as is default
    – Komu
    Feb 4, 2015 at 13:35
  • @Komu you saved me :)
    – annndrey
    Oct 9, 2019 at 18:15
  • Thanks, in my case i also had to enable the firewall
    – D4ITON
    Mar 17 at 1:09
1

This worked for me:

server {
listen       80;
server_name  localhost;
...
if ($http_x_forwarded_proto = "http") {
      return 301 https://$server_name$request_uri;
}
location / {
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Server $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass http://localhost:8080;
}

...
}
-1

You can

  1. use $server_name to avoid hard coding your domain name again (DRY),
  2. use return 301 for a bit easier reading (a web dev should know this http status code)

Note: I put 443 for https server. You may listen to 8001 if you really want that.

server {
    listen   80;
    server_name  your_hostname.com;

    return 301 https://$server_name$request_uri;
}
...
server {
    listen 443 ssl;
    server_name your_hostname.com
    ...
}
5
  • well i use reverse proxy with nginx because i got different RoR environement for each apps. So i start my app with a standalone server Passanger + nginx and use a reverse proxy to add thoses SSL Certs. Because i can't add SSL Cert path with the standalone version.
    – rbinsztock
    Mar 15, 2013 at 11:52
  • If i change error_page 497 https://$host:$server_port$request_uri; by return 301 https://$host:$server_port$request_uri; I got this and the redirect is broke again. 400 Bad Request The plain HTTP request was sent to HTTPS port
    – rbinsztock
    Mar 15, 2013 at 12:14
  • I see. Your answer should be the best answer. your question is that it's going through a nonstandard port, and you want to redirect from http to https on the SAME port. So it's impossible to set up 2 server blocks like I originally thought, because you can't have 2 server blocks listening to the same port.
    – Chuan Ma
    Mar 15, 2013 at 14:54
  • 1
    @senayar why not answer your own question? and I'll upvote yours. So it's easier for other people to learn from this. Also please update the question itself and state the main issue: redirecting on the same port from http to https
    – Chuan Ma
    Mar 15, 2013 at 14:56
  • i can't accept my own answer in 2 days :) but it's done thank. Maybe someone can propose another solution. Thank for your help!
    – rbinsztock
    Mar 15, 2013 at 15:12
-1

This is my approach, which I think is quite clean and allows you to add further locations if needed. I add a test on the $http_x_forwarded_proto property which if true forces all HTTP traffic to HTTPS on a NGINX Reverse Proxy setup

upstream flask_bootstrap {
    server flask-bootstrap:8000;
}

server {
    # SSL traffic terminates on the Load Balancer so we only need to listen on port 80
    listen 80;

    # Set reverse proxy
    location / {
        proxy_pass http://flask_bootstrap;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $host;
        proxy_redirect http://localhost/;

        # Permanently redirect any http calls to https
        if ($http_x_forwarded_proto != 'https') {
            return 301 https://$host$request_uri;
        }
    }
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.