I have a basic ASP.NET application that sits behind an F5 load-balancer.
Incoming SSL requests (over HTTPS) terminate at the load-balancer and all internal communication between the load-balancer and my application servers is unsecure (over HTTP).
When a unsecure request comes in, my app is able to use Response.Redirect("https://...") to redirect a secure URL with no problems. However, the other direction appears to be impossible – I cannot redirect from HTTPS to HTTP using Response.Redirect() from my application. The URL remains HTTPS for the client and does not change. Could the F5 be preventing the redirect for ever reaching the client?
Is there any special configuration necessary to let this happen?
Best Answer
Yes, the F5 may be intercepting and rewriting the redirect to be HTTPS.
Find the HTTP Profile that is associated with your Virtual Server. What is "Rewrite Redirects" set to? Since you're the developer of the app, you probably want None. (Remember to make a new HTTP profile for your app rather than edit the default one.)
This option is designed to handle redirects from applications that aren't really SSL Offload aware.
There's a good article about this option on DevCentral.
On a related note, why are you redirecting back to HTTP? If your BIG-IP is hardware (not Virtual Edition) then it probably handles 500-2000 SSL TPS depending on licensed modules. What is your traffic load? I'm guessing you're unlikely to be establishing over 500 new SSL connections per second. It could be easier and more secure to keep everything on HTTPS.