Loading page without https

Question

I setup my site at AWS with Route53 and load balancer is fronting with https.

My load balancer is opened only for https.

I can't load my page without https.

I see links with https, for example www.google.com, even they have https I don't need to key in https in the browser.

Just key in www.google.com in the browser and https://www.google.com is loaded.

But for me www.domainname.com is keyed in, but https://www.domainname.com is not loaded.

How do I set up for that? Is it the issue in AWS to setup?

No, google just redirects you from it's http site to its https site. — pvg, Apr 29 '17 at 06:01
@pvg but at my case, how can I redirect from http to https site. How can I set up ? — batuman, Apr 29 '17 at 09:38
This is redirecting from http to https. I see some discussion here. http://stackoverflow.com/questions/24603620/redirecting-ec2-elb-from-http-to-https — batuman, Apr 29 '17 at 09:45

score 2 · Accepted Answer · answered Apr 29 '17 at 09:50

2

If your load balancer is opened only for HTTPS, then nothing listens for HTTP request on port 80. You should allow for both HTTP and HTTPS and configure your web server to always redirect from HTTP to HTTPS. That's what Google does.

answered Apr 29 '17 at 09:50

Sergey Kovalev

9,110
2
28
32

1

"*That's what Google does."* Google runs on ELB? I'm kidding. This answer is spot-on. For the benefit of those who are less familiar with ELB, we might mention that either the presence of an `X-Forwarded-Proto: http` header in the request or the absence of `X-Forwarded-Proto: https` are ways for the web server itself or the application running there to determine which protocol was used to connect to an ELB, and return a redirect. The header is added by ELB and can't be forged by the browser. – Michael - sqlbot Apr 29 '17 at 11:22
According to the discussion here (https://forums.aws.amazon.com/thread.jspa?messageID=745509), I need to have redirect RewriteEngine on RewriteCond %{HTTP:X-Forwarded-Proto} !https RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L] inside .htaccess. That means I make .htaccess file inside webpage's root folder and copy that code inside the file? – batuman Apr 30 '17 at 15:10

score 1 · Answer 2 · answered Apr 30 '17 at 16:07

What @Sergey Kovalev answered is correct. I need to open both http and https at elb. Then setup redirecting at the folder where your page is located, means where index.php is located.

How to setup is that, in the file .htaccess, put the following X-Forwarded-Proto code

<VirtualHost *:80>
    RewriteEngine On
    RewriteCond %{HTTP:X-Forwarded-Proto} !https
    RewriteCond %{HTTP_USER_AGENT} !^ELB-HealthChecker
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301,NE]
</VirtualHost>

Then put the code inside the folder where index.php is located.

Then it works.

Loading page without https

2 Answers2