Apache
When you enable HTTPS for your website, you should enforce that HTTPS is being used by automatically redirecting users who access your site over HTTP to the HTTPS version. When using Apache, this is done via a host redirect entry with mod_rewrite:
<VirtualHost *:80>
# Beginning declarations here
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI}
# Rest of entry here...
</VirtualHost>
Apache Behind an ELB
However, in the Amazon Web Services world, most applications utilize the load balancer as an SSL-termination point. This means that the traffic is decrypted at the load balancer and all traffic being sent to the final destination instances is actually sent over HTTP (from a security standpoint, this is generally an accepted practice as the load balancer and instance are in the same network, and thus secure from eavesdropping). If you used the rule above, your users would wind up in an endless redirect loop.
To fix this, the "RewriteCond" needs to be changed to:
RewriteCond %{HTTP:X-Forwarded-Proto} !https
This rule will check to see which protocol the user was using before he or she hit the load balancer - which is what HTTPS redirection should use.
Node.js
When using Node.js, the same thing can be accomplished by inserting some middleware that listens for all traffic and redirects the non-HTTPS requests to their HTTPS equivalents.
var myApp = express () ,
myServer = http.createServer(myApp);
myApp.use(function redirectHTTP(req, res, next) {
if (!req.secure) {
return res.redirect('https://' + req.headers.host + req.url);
}
next();
});
Node.js Behind an ELB
Just as in our first Apache example, this works great until it is placed behind a load balancer. If you're using a load balancer, you need to make some modifications. Instead of "req.secure", do the following:
if (req.headers['x-forwarded-proto'] && req.headers['x-forwarded-proto'].toLowerCase() === 'http') {
return res.redirect('https://' + req.headers.host + req.url);
}
Using these techniques, you should be able to enforce the new HTTPS version of your website. Remember - if you serve both an HTTPS and an HTTP version of your site, the HTTPS is rendered pointless unless you also redirect the HTTP requests.
