How to force https on elastic beanstalk?

Question

I can't seem to force https on the free usage tier of elastic beanstalk.

I have tried the following suggestion at How to force https on amazon elastic beanstalk without failing the health check

Using this Apache rewrite rule

RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteCond %{REQUEST_URI} !^/status$ 
RewriteCond %{REQUEST_URI} !^/version$ 
RewriteCond %{REQUEST_URI} !^/_hostmanager/ 
RewriteRule . https://%{SERVER_NAME}%{REQUEST_URI} [L,R]

When I try that, http requests do not get redirected to https as I would like. Instead, the http page loads normally. I've also tried to use the X-Forwarded-Port header with the same result.

I've also tried the following rewrite rule

RewriteCond %{SERVER_PORT} 80
RewriteRule . https://%{SERVER_NAME}%{REQUEST_URI} [L,R]

And this rule causes a redirect loop. So it would seem that the apache rewrite rules don't pick up the Elastic Load Balancer headers X-Forwarded-Port and X-Forwarded-Proto, but also a redirect loop isn't what I am going for either.

Please help. I am new to AWS, Elastic Beanstalk, and not very familiar with Apache rules. I am not too sure where to go from here. Thanks.

Answer 1

It's work for me with the next command:

RewriteCond %{HTTP:X-Forwarded-Port} !=443

and without the https check:

RewriteCond %{HTTP:X-Forwarded-Proto} !https

It's look like ELB change the value of X-Forwarded-Proto to http (even on TCP protocol).

Answer 2

We have solved it on our backend by handling X-Forwarded-Proto properly.

This is our Grails config but it will help you with the idea:

    grails.plugin.springsecurity.secureChannel.useHeaderCheckChannelSecurity = true
    grails.plugin.springsecurity.portMapper.httpPort = 80
    grails.plugin.springsecurity.portMapper.httpsPort = 443
    grails.plugin.springsecurity.secureChannel.secureHeaderName = 'X-Forwarded-Proto'
    grails.plugin.springsecurity.secureChannel.secureHeaderValue = 'http'
    grails.plugin.springsecurity.secureChannel.insecureHeaderName = 'X-Forwarded-Proto'
    grails.plugin.springsecurity.secureChannel.insecureHeaderValue = 'https'
    grails.plugin.springsecurity.secureChannel.definition = [
        [pattern: '/**', access: 'REQUIRES_SECURE_CHANNEL']
    ]

Answer 3

Why don't you simply put an .htaccess file in the root folder? That way you can simply test and debug it. And if you include it in the .zip, it will automatically deployed on all instances again.

Simply use .htaccess:

RewriteEngine on
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R,L]

Answer 4

To extend another two answers to this question https://stackoverflow.com/a/43026082/8775205, https://stackoverflow.com/a/42035023/8775205. For spring boot users who deploy their services on AWS with ELB, and need step by step guide, you can add an ****.conf file under src/main/webapp/.ebextensions/httpd/conf.d/ in your project.

src
--main
----java
----resources
----webapps
------.ebextensions
--------httpd
----------confd
------------****.conf

****.conf looks like the following. Noticed that I have my testing site with a single instance, so I add a condition to exclude it.

<VirtualHost *:80>
   LoadModule rewrite_module modules/mod_rewrite.so

   RewriteEngine On
   RewriteCond %{HTTP:X-Forwarded-Proto} !https
   RewriteCond %{HTTP_USER_AGENT} !ELB-HealthChecker 
   RewriteCond %{HTTP_HOST} !testexample.com #excludes test site
   RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

   <Proxy *>
     Order deny,allow
     Allow from all
   </Proxy>

   ProxyPass / http://localhost:8080/ retry=0
   ProxyPassReverse / http://localhost:8080/
   ProxyPreserveHost on

   ErrorLog /var/log/httpd/elasticbeanstalk-error_log

</VirtualHost>

After this, remember to add a "resource" under maven-war-plugin in your pom.xml in order to pick up the above configuration.

<plugin>
     <groupId>org.apache.maven.plugins</groupId>  
     <artifactId>maven-war-plugin</artifactId>  
     <configuration>  
         <webResources>
             <resource>  
               <!-- some other resource configured by yourself-->
             </resource> 
             <resource>
                <directory>src/main/webapps/.ebextensions</directory>
                 <targetPath>.ebextensions</targetPath>
                 <filtering>true</filtering>
             </resource> 
         </webResources>  
     </configuration>  
     <version>2.1.1</version>
 </plugin>

Finally commit and push your code, wait AWS codebuild and codepipeline to pick up your code from your repository and deploy to beanstalk environment, or simply pack your project into a war file and upload it to your AWS beanstalk environment

Answer 5

AWS do not accept unserscores (_) in headders, while we can use (-), So Remove underscores from the header variables, example:- header_var_val = "some value" replace it with headervarval = "some value". It works for me.

Answer 6

None of the above answers worked for me but some helped me to figure out the answer that worked for me Also I found the below url which helped http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/java-tomcat-platform.html

I created the file structure mentioned in above url to change 2 files httpd.conf 00_application.conf

copy the whole httpd.conf from your instance and put it in your code under .ebextention under the folder structure mentioned in the above link. Then just add below line to that file in your project

LoadModule rewrite_module modules/mod_rewrite.so

Do that same for 00_application.conf, copy it from your instance and place it in your codebase under .ebextention under httpd/conf.d/elasticbeanstalk/00_application.conf Now edit this file and add the below between VirtualHost

RewriteEngine on
RewriteCond %{HTTP:X-Forwarded-Proto} =http
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Now deploy your code It should work.