F5 BIG-IP monitor to detect http to https redirects

f5-big-iphttphttpsredirect

We have an F5 BIG-IP load-balancer we use in front of a web application hosted by several identical servers. The application listens on port 443 for SSL/TLS requests and port 80 for http requests. However, the only thing that happens to an http port 80 request is that it gets a 302 redirect response.

I am trying to create a monitor for the F5 pool used for port 80 that detects that the service is working properly, i.e., that http requests get redirected to https. However, I cannot find a monitor to do this.

Is there such a monitor?

Best Answer

To check that a redirect happens, create a monitor of type HTTP, set the send string to GET / HTTP/1.0\r\n and the receive string to 302 Found.

As far as I can tell, the HTTP monitor type adds a single \r\n because it intends to work with HTTP 0.9, but there's no way to send a redirect in HTTP 0.9, so you have to use 1.0, which requires another \r\n.

To check the destination, try a receive string of Location: https://, possibly with the specific hostname you're interested in appended.

Correct way in new versions of nginx

Turn out my first answer to this question was correct at certain time, but it turned into another pitfall - to stay up to date please check Taxing rewrite pitfalls

I have been corrected by many SE users, so the credit goes to them, but more importantly, here is the correct code:

server {
       listen         80;
       server_name    my.domain.com;
       return         301 https://$server_name$request_uri;
}

server {
       listen         443 ssl;
       server_name    my.domain.com;
       # add Strict-Transport-Security to prevent man in the middle attacks
       add_header Strict-Transport-Security "max-age=31536000" always; 

       [....]
}

Ssl – Possible to redirect from HTTPS to HTTP behind load-balancer

Yes, the F5 may be intercepting and rewriting the redirect to be HTTPS.

Find the HTTP Profile that is associated with your Virtual Server. What is "Rewrite Redirects" set to? Since you're the developer of the app, you probably want None. (Remember to make a new HTTP profile for your app rather than edit the default one.)

This option is designed to handle redirects from applications that aren't really SSL Offload aware.

There's a good article about this option on DevCentral.

On a related note, why are you redirecting back to HTTP? If your BIG-IP is hardware (not Virtual Edition) then it probably handles 500-2000 SSL TPS depending on licensed modules. What is your traffic load? I'm guessing you're unlikely to be establishing over 500 new SSL connections per second. It could be easier and more secure to keep everything on HTTPS.

Best Answer

Related Solutions

Nginx – In Nginx, how can I rewrite all http requests to https while maintaining sub-domain

Correct way in new versions of nginx

Ssl – Possible to redirect from HTTPS to HTTP behind load-balancer

Related Topic