How to redirect on the same port from http to https with nginx reverse proxy

Question

I use reverse proxy with Nginx and I want to force the request into HTTPS, so if a user wants to access the url with http, he will be automatically redirected to HTTPS.

I'm also using a non-standard port.

Here is my nginx reverse proxy config:

server {
    listen 8001  ssl;
    ssl_certificate /home/xxx/server.crt;
    ssl_certificate_key /home/xxx/server.key;
    location / {
        proxy_pass https://localhost:8000;
        proxy_redirect off;
        proxy_set_header Host $host:$server_port;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Ssl on;
        proxy_set_header  X-Forwarded-Proto  https;
    }
}

I've tried many things and also read posts about it, including this serverfault question, but nothing has worked so far.

To reopen reviewers: This question is definitely related to programming, and very specific. Just that the 'non-standard port' was not mentioned before, which might have made it a little vague before. — bool.dev, Feb 05 '14 at 14:54
It's downright wrong that this was closed as off topic. nginx is a common tool used in programming, and the highest rated solution present the correct code to fix the problem: `error_page 497 https://$host:$server_port$request_uri;` — mgoldwasser, Jun 25 '14 at 20:15

rbinsztock · Accepted Answer · 2019-11-30T15:57:18.500

112

Found something that is working well :

server {
        listen 8001  ssl;
        ssl_certificate /home/xxx/server.crt;
        ssl_certificate_key /home/xxx/server.key;
        error_page 497 301 =307 https://$host:$server_port$request_uri;
        location /{
            proxy_pass http://localhost:8000;
            proxy_redirect off;
            proxy_set_header Host $host:$server_port;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Ssl on;
        }
}

edited Nov 30 '19 at 15:57

answered Mar 15 '13 at 15:09

rbinsztock

3,025
2
21
34

14

error code 497 is created especially for this use case [redirect on the same port from http to https]. I think this is the best answer. http://wiki.nginx.org/HttpSslModule#Nonstandard_error_codes – Chuan Ma Mar 15 '13 at 15:23
2

Thanks a lot!! `error_page 497 https://$host:$server_port$request_uri;` did the trick! – Adrian Nov 06 '14 at 20:41
6

I would consider adding: `error_page 497 301 =307 https://$host:$server_port$request_uri;` That way the request method isn't auto converted to a GET as is default – Komu Feb 04 '15 at 13:35
@Komu you saved me :) – annndrey Oct 09 '19 at 18:15
Thanks, in my case i also had to enable the firewall – D4ITON Mar 17 '23 at 01:09

score 2 · Answer 2 · answered Mar 15 '13 at 11:21

Are you sure your solution is working? It is listening for 8001 ssl. Will it accept http request?

I do it this way:

server {
    listen   80;
    server_name  yourhostname.com;

    location / {
            rewrite ^(.*) https://yourhostname.com:8001$1 permanent;
    }
}

Then goes your config:

server {
    listen 8001  ssl;
    ssl_certificate /home/xxx/server.crt;
    ssl_certificate_key /home/xxx/server.key;
    location / {
        proxy_pass https://localhost:8000;
        proxy_redirect off;
        proxy_set_header Host $host:$server_port;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Ssl on;
        proxy_set_header  X-Forwarded-Proto  https;
    }
}

yes my solution is working, port 80 is already used by another nginx server with subdomain passenger_base uri. — rbinsztock, Mar 15 '13 at 12:25

score 0 · Answer 3 · answered Jun 06 '18 at 20:28

This worked for me:

server {
listen       80;
server_name  localhost;
...
if ($http_x_forwarded_proto = "http") {
      return 301 https://$server_name$request_uri;
}
location / {
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Server $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass http://localhost:8080;
}

...
}

score -1 · Answer 4 · answered Mar 15 '13 at 11:47

-1

You can

use $server_name to avoid hard coding your domain name again (DRY),
use return 301 for a bit easier reading (a web dev should know this http status code)

Note: I put 443 for https server. You may listen to 8001 if you really want that.

server {
    listen   80;
    server_name  your_hostname.com;

    return 301 https://$server_name$request_uri;
}
...
server {
    listen 443 ssl;
    server_name your_hostname.com
    ...
}

answered Mar 15 '13 at 11:47

Chuan Ma

9,754
2
45
37

well i use reverse proxy with nginx because i got different RoR environement for each apps. So i start my app with a standalone server Passanger + nginx and use a reverse proxy to add thoses SSL Certs. Because i can't add SSL Cert path with the standalone version. – rbinsztock Mar 15 '13 at 11:52
If i change error_page 497 https://$host:$server_port$request_uri; by return 301 https://$host:$server_port$request_uri; I got this and the redirect is broke again. 400 Bad Request The plain HTTP request was sent to HTTPS port – rbinsztock Mar 15 '13 at 12:14
I see. Your answer should be the best answer. your question is that it's going through a nonstandard port, and you want to redirect from http to https on the SAME port. So it's impossible to set up 2 server blocks like I originally thought, because you can't have 2 server blocks listening to the same port. – Chuan Ma Mar 15 '13 at 14:54
1

@senayar why not answer your own question? and I'll upvote yours. So it's easier for other people to learn from this. Also please update the question itself and state the main issue: redirecting on the same port from http to https – Chuan Ma Mar 15 '13 at 14:56
i can't accept my own answer in 2 days :) but it's done thank. Maybe someone can propose another solution. Thank for your help! – rbinsztock Mar 15 '13 at 15:12

score -1 · Answer 5 · answered Jan 25 '20 at 15:19

This is my approach, which I think is quite clean and allows you to add further locations if needed. I add a test on the $http_x_forwarded_proto property which if true forces all HTTP traffic to HTTPS on a NGINX Reverse Proxy setup

upstream flask_bootstrap {
    server flask-bootstrap:8000;
}

server {
    # SSL traffic terminates on the Load Balancer so we only need to listen on port 80
    listen 80;

    # Set reverse proxy
    location / {
        proxy_pass http://flask_bootstrap;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $host;
        proxy_redirect http://localhost/;

        # Permanently redirect any http calls to https
        if ($http_x_forwarded_proto != 'https') {
            return 301 https://$host$request_uri;
        }
    }
}

How to redirect on the same port from http to https with nginx reverse proxy

5 Answers5

Linked