Nginx SSL redirect without if

Question

In this question: rewrite http to https with ngnix behind load balancer

the question is how to force SSL for nginx servers behind a loadbalancer. The problem with this setup is that the loadbalancer handles SSL and has a non SSL connection with the webservers/nodes.

So it looks at the http-x-forwarded-proto header. The accepted answer works fine except that it uses an if like so:

if ($http_x_forwarded_proto = "http") {
            rewrite  ^/(.*)$  https://mydomain.com/$1 permanent;
}

which is evil: http://wiki.nginx.org/IfIsEvil

Is there a better way to do this without an if?

One possible solution would be to force ssl at the loadbalancer, but this loadbalancer is managed by our hoster, which makes changes more tedious, im hoping for an answer which doesn require changes to the loadbalancer

Michael Hampton · Accepted Answer · 2014-07-07T19:01:25.980

1

Since you have nginx behind an SSL-terminating load balancer, I don't think it will be easy for you to avoid using if. But not all is lost.

To be "not evil" you can replace rewrite permanent with return, one of the safe things you can do with if.

    return 301 https://$http_host$request_uri;

This will simply reconstruct the URL with https, and everything else exactly as given.

edited Jul 07 '14 at 19:01

answered Jul 07 '14 at 13:06

Michael Hampton

244,070
43
506
972

`$request_uri` already contains arguments. – Alexey Ten Jul 07 '14 at 13:42
1

Also [HSTS](http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) could add some benefits. – Alexey Ten Jul 07 '14 at 13:42
If so, then I suppose you can just omit the "second" args. – Michael Hampton Jul 07 '14 at 13:55
@AlexeyTen but with HSTS nginx would still run the if logic I guess? – Richard Deurwaarder Jul 09 '14 at 07:39
Yes. HSTS just forces use of https for clients that use it. So it will reduce number of redirects from http to https. – Alexey Ten Jul 09 '14 at 07:51

Nginx SSL redirect without if

1 Answers1