HTTP after redirect, should be HTTPS

If it's as simple as http:// URLs bleeding through to the client from HTTP redirects, you can do something like this:

when HTTP_REQUEST {
    if { [HTTP::header exists Location] } {
        HTTP::header replace Location [string map -nocase {"http://" "https://"} [HTTP::header Location]]
    }
}

That will replace any http:// in a redirect with https://.

Yes, perhaps that could work! But I'd like to check the response-header to see what I have to change to what. Local 0. doesn't seem to work in a HTTP_REPONSE ... Any ideas? TIA,

Huub.

Local 0. doesn't seem to work in a HTTP_REPONSE.

what is not working?

this is mine.

 config

root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm rule myrule
ltm rule myrule {
    when HTTP_RESPONSE {
        log local0. "before \[HTTP::header Location\]=[HTTP::header Location]"
  if { [HTTP::header exists Location] } {
    HTTP::header replace Location [string map -nocase {"http://" "https://"} [HTTP::header Location]]
  }
  log local0. "after \[HTTP::header Location\]=[HTTP::header Location]"
}
}

 /var/log/ltm

[root@ve11a:Active:In Sync] config  tail -f /var/log/ltm
Feb  6 05:39:51 ve11a info tmm[13662]: Rule /Common/myrule : before [HTTP::header Location]=http://www.domain.com/somethingelse
Feb  6 05:39:51 ve11a info tmm[13662]: Rule /Common/myrule : after [HTTP::header Location]=https://www.domain.com/somethingelse

I get strange results. This is my (test) iRule:

when HTTP_REQUEST { if { [string tolower [ HTTP::host ] ] equals "inkoopveerle.neck.nl" } { pool pl-dmz-cl20inkp } elseif { [string tolower [ HTTP::host ] ] equals "proef.neck.nl"} { log local0. "before1 [HTTP::header Location]=[HTTP::header Location]" if { [HTTP::header exists Location] } { HTTP::header replace Location [string map -nocase {"http://" "https://"} [HTTP::header Location] ] log local0. "after2 [HTTP::header Location]=[HTTP::header Location]" } pool pl-dmz-cl20inkp-proef } else { HTTP::respond 200 content {No such Application} }

And this is the logging: Rule–ir-dmz-cl20inkp_80 : before1 [HTTP:header Location]= Rule–ir-dmz-cl20inkp_80 : before3 [HTTP:header Location]=

So: no info ... :-(

Setup a port 80 vip, and add an http to https redirect irule: when HTTP_REQUEST { HTTP::redirect "https://[HTTP::host][HTTP::uri]" }

Thanks! Going to try that.

You could also do port translation (from 443 to 80); that way the client can continue to use SSL but you're using 80 behind the BIG-IP.

Thanks to everybody for all the suggestions. In our case, the HTTP::redirect worked best. Thanks again! Huub.