0

I have setup a GCP load balancer following the steps as displayed on https://cloud.google.com/load-balancing/docs/https/ext-http-lb-tf-module-examples#with_a_backend . I have create an A record at my dns provider and I am succesfully able to reach my service through the domain name. I have also created a http to https redirecting load balancer, which only redirects when visiting the domain name.

However my problem is that I can also still directly access my load balancers ip adress over http, which in turn redirects to my backend service thus allowing insecure access to my service. I am not sure what steps there are to debug my configurations or if anyone has experienced something similar.

FFGH
  • 121
  • 12

1 Answers1

2

The simplest method is to redirect HTTP to HTTPS at your backend. That method provides you with more options and control.

Tip: if the client arrives at an IP address, you most likely want to discard that traffic. That traffic is typically hackers, trolls, etc.

You can also set up a redirect in the load balancer:

Set up an HTTP-to-HTTPS redirect for global external HTTP(S) load balancer

John Hanley
  • 74,467
  • 6
  • 95
  • 159
  • I have already setup a http redirecting load balancer. This works fine when visiting the domain name itself, but there is no redirect when hitting the ip. – FFGH Jun 21 '22 at 19:11
  • @FFGH redirect IP Host requests from HTTP to HTTPS at your backend. The Google Cloud HTTP Load Balancer is domain name based not IP based. – John Hanley Jun 21 '22 at 19:13