I've been trying to get http to https redirect via nginx for the better part of a day, and it's been a struggle. I've checked over several stackoverflow questions, and a number of articles on the internet. I finally got http to https redirect, but only for the direct ip address, not the domain I'm trying to use.
So in other words, http://12.345.67.890 redirects to https://app.example.com, but http://app.example.com does not redirect to https://app.example.com.
Is this expected? What don't I understand here?
My site's config file
upstream appupstream { server 0.0.0.0:3555;}server { error_log /var/log/nginx/error.log warn; listen [::]:80; listen 80; server_name app.example.com 12.345.67.890; return 301 https://$server_name$request_uri; access_log /var/log/nginx/access.log; root /home/ec2-user/app/public; proxy_set_header X-Forwarded-Proto $scheme; location / { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $http_host; proxy_set_header X-NginX-Proxy true; proxy_pass https://appupstream; }}
When I curl these sites, the headers seem to support what I'm seeing in my browsers:
IP curl results
$ curl -I -L http://12.345.67.890HTTP/1.1 301 Moved Permanently // <-- Note the permanent redirect on the ipServer: nginx/1.12.1Date: Sat, 03 Nov 2018 19:30:10 GMTContent-Type: text/htmlContent-Length: 185Connection: keep-aliveLocation: https://app.example.com/HTTP/2 200date: Sat, 03 Nov 2018 19:30:10 GMTcontent-type: text/html; charset=utf-8content-length: 4856x-frame-options: SAMEORIGINx-xss-protection: 1; mode=blockx-content-type-options: nosniffx-download-options: noopenstrict-transport-security: max-age=15778476; includeSubDomainsp3p: ABCDEF
Domain curl results
$ curl -I -L http://app.example.comHTTP/1.1 200 OK // <-- No permanent redirect on domainDate: Sat, 03 Nov 2018 19:30:39 GMTContent-Type: text/html; charset=utf-8Content-Length: 4856Connection: keep-aliveX-FRAME-OPTIONS: SAMEORIGINX-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffX-Download-Options: noopenStrict-Transport-Security: max-age=15778476; includeSubDomainsP3P: ABCDEF
I've run nginx -t
successfully, and I've used both nginx reload
and nginx restart
each time I've updated the file. I've cleared ALL browsing data (cookies, etc.) and revisited, but this behavior persists. Any suggestions/guidance would be much appreciated!