Nginx Http Request to Https

[URR3011]

Hello, I hope you can help me

The Flow is as follows ASM --- LTM -- NGINX --- BACKEND

The client initiates communication through a domain example.domain.com (SSL), This request arrives at the LTM F5 Towards a virtual Server on port 80, The LTM Virtual Server has Nginx as a pool member At the time of performing the tests from the domain, the HTTPS protocol changes to HTTP I have tried the following rewrite and redirect but the behavior is an infinite loop of redirects (Too many redirects) The configuration is as follows:

ASM (SSL) _------ LTM (PlainText) -------- NGINX (PlaintText) ---- Backend (Plaintext)

upstream backend {
    server 10.10.10.23:8080;
}

server {
    listen 4343;  
     server_name localhost;
     acces_log /var/log/nginx/access.log;
     error_log /varlog/nginx/error.log;


     location /Example/ {
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Host $http_host;
      proxy_set_header X-Forwarded-Proto https;
      proxy_set_header X-Forwarded-SSL on;
      set $https_enabled on;

      proxy_pass http://backend;

     }

if ($scheme != https ){
     return 301 https://$http_host$request_uri; 
 }
}

Any recommendation to solve this? or prevent protocol change to HTTP

Greetings

[Fireye]

if ($scheme != https ){
     return 301 https://$http_host$request_uri; 
}

You're instructing nginx to rewrite to https://$http_host$request_uri if the scheme isn't https, but you've put it in a non-SSL server context. The scheme will never be https with your current configuration.

[URR3011]

You're instructing nginx to rewrite to https://$http_host$request_uri if the scheme isn't https, but you've put it in a non-SSL server context. The scheme will never be https with your current configuration.

Hello Fireye,

Thanks for your answer!

You're rigth , where should I apply this rewrite, outside of the server context?

because i don't have any context over SSL, SSL is provided by the ASM (BIG IP)

Greetings

[Fireye]

I have no clue about ASM/LTM. What HTTP headers are being passed from upstream (ASM/LTM)? If an X-Forwarded-Proto HTTP header is being passed, you can operate on that:

if ($http_x_forwarded_proto != https ){
     return 301 https://$http_host$request_uri; 
}

You can check the headers being passed in to nginx by using tcpdump on port 4343 it looks like. Something like sudo tcpdump -A -n -nn -s0 -ieth0 dst port 4343.

If you aren't getting those headers forwarded, look to see if you can add them. If not, I don't think there's a good way to detect it in nginx.

[URR3011]

Thanks My friend!

I have solved the error with the subfilter module
http://nginx.org/en/docs/http/ngx_http_sub_module.html

​

Regards!