2

I’ve got a lighttpd server behind an AWS load balancer. The ELB handles all the SSL stuff for me and forwards the requests to lighttpd over HTTP on port 80, setting the X-Forwarded-Proto header along the way.

As I only want to have one specific page go via HTTPS and everything else over HTTP, I wanted to setup redirects in the lighttpd config file, like:

$HTTP["scheme"] == "https" {
    $HTTP["host"] !~ ".*ttc/(index.html)?$" {
        $HTTP["host"] =~ "(.*)" {
            url.redirect = ( "^(.*)$" => "http://%1$1")
        }
    }
}

This, of course, doesn’t work, as lighttpd only sees HTTP requests…

I had a look at mod_extforward, but that only seems to provide access to the X-Forwarded-For header.

I’ll appreciate any suggestions on how to address this, without switching away from lighttpd.

Ventzi Zhechev
  • 487
  • 1
  • 4
  • 12

2 Answers2

0

I couldn't find answer to this so I've hacked using port configuration as follows:

HTTPS 443 (elb) => 80 (instance)
HTTP  80  (elb) => 81 (instance)

and in Lighttpd config:

$SERVER["socket"] == ":81" {
    # capture vhost name with regex conditiona -> %0 in redirect pattern
    # must be the most inner block to the redirect rule
    $HTTP["host"] =~ ".*" {
        url.redirect = (".*" => "https://%0$0")
    }
}

So basically when Lighttpd detects that connection is made to 81, it just redirects it to https.

ooxio
  • 806
  • 1
  • 10
  • 13
  • This doesn’t answer the question, as I didn’t want all requests to go to HTTPS. The only thing that I want encrypted are requests to the login page I have—the rest can safely be plain HTTP. – Ventzi Zhechev Apr 25 '15 at 12:30
  • Yeah probably added it to wrong question. Anyway, maybe you can utilize my solution in your solution. There's no direct way to do it like you wish. – ooxio Apr 25 '15 at 13:29
0

What version of lighttpd are you using? I am looking at 1.4.36 and see that mod_extforward.c does handle X-Forwarded-Proto.

If this still does not work for you with lighttpd 1.4.36, perhaps mod_extforward needs to be loaded prior to some other modules in your lighttpd.conf?

gstrauss
  • 2,091
  • 1
  • 12
  • 16
  • I’m pretty sure we had an earlier version of lighttpd at the time when I posted the question. I’ve now moved to a new job, however, so I can’t check. – Ventzi Zhechev Aug 19 '15 at 09:05