Clarify documentation HTTP Redirects

[meersau]

Tried to redirect http to https with service tags. I followed the documentation https://fabiolb.net/feature/http-redirects/ which says:

To redirect from HTTP to HTTPS you must include the host:port of the HTTP endpoint

It did not work. I also have to include the port for the HTTPS rule.

Did not work:

urlprefix-web1.traefik/,urlprefix-web1.traefik:80/ redirect=301,https://web1.traefik/

Did work:

urlprefix-web1.traefik:443/,urlprefix-web1.traefik:80/ redirect=301,https://web1.traefik/

It surely is clear for users which uses fabiolb for some time, but I just evalute fabiolb, so for me was it not clear. I found some issues about this topic, so perhaps the documentation can be a bit clearer about redirecting.

[aaronhurt]

The actual route rule you want to make would look like this ...

route add http-redirect www.example.com:80 https://www.example.com$path opts "redirect=301"

So probably something like ...

urlprefix-www.example.com:80 redirect=301,https://www.example.com$path

You should only need the port on the incoming HTTP route as that's the one you want to ensure doesn't ever hit for traffic that is already coming as HTTPS (avoid redirect loop).

[meersau]

If I register the service with "urlprefix-host/" I have working HTTP and HTTPS.

If I then register also "urlprefix-host:80/ redirect=301,https://url" I still have working HTTP and HTTPS. No redirect happen.
If I register "urlprefix-host:443/" and "urlprefix-host:80/ redirect ..." it works.

Perhaps it has something to do with the matching of routes.

[aaronhurt]

How are you configuring the tags? I assume you are placing multiple urlprefix- tags on the same service, correct?

So you have one service with the following tags:
urlprefix-example.com/, urlprefix-example.com:80/ redirect=301,https://example.com$path

and that doesn't work? It's only working if you make it ...
urlprefix-example.com:443/, urlprefix-example.com:80/ redirect=301,https://example.com$path

Is that what you're saying? I'd really like to see your actual route table. Copy and paste the output from

curl <fabio-host>:9998/api/routes?raw

[meersau]

How are you configuring the tags? I assume you are placing multiple urlprefix- tags on the same service, correct?

Correct.

So you have one service with the following tags:
urlprefix-example.com/, urlprefix-example.com:80/ redirect=301,https://example.com$path

and that doesn't work? It's only working if you make it ...
urlprefix-example.com:443/, urlprefix-example.com:80/ redirect=301,https://example.com$path

Correct. Only without $path.

Is that what you're saying? I'd really like to see your actual route table. Copy and paste the output from

curl <fabio-host>:9998/api/routes?raw

curl "localhost:9998/api/routes?raw"
route add web1 web1.traefik:80/ https://web1.traefik/ opts "redirect=301"
route add web1 web1.traefik:443/ http://10.11.11.178:8081/

[aaronhurt]

Thank you. You really shouldn't need the 443 port designation as the routing table is "most specific" match first. Please also keep in mind with your current route table if someone accesses http://web1.traefik/apples that will get redirected to https://web1.traefik/ and you will loose the original path. That's the reason for using the $path pseudo variable.

I'll try and do some more local testing here but in our production environment we don't have a specific route with a443 port.

We basically have the following (with a lot of other routes)...

route add http-redirect example.com:80/ https://example.com$path opts "redirect=301"
route add products / http://10.1.2.3:80/

[meersau]

Thank you. Yes, the $path would be better for production :-)

Did you add the http-redirect as Service Tag?

I use Version 1.5.11 if this helps.

[aaronhurt]

We do it a bit different ... the last route there, and all the rest of our routes, are created from urlprefix- tags on the various services and they get a route name that matches their service name. The redirect routes we add via raw config in the KV store using the registry.consul.kvpath setting in the config. You can set that to a path in consul and then add manual route configuration as needed. That is where we create our redirects ... the content of that key on our hosts just has all of our redirects...

route add http-redirect dev.ena.net:80 https://dev.ena.net$path opts "redirect=301"
route add http-redirect vault.dev.ena.net:80 https://vault.dev.ena.net$path opts "redirect=301"
route add http-redirect vlt01.dev.ena.net:80 https://vlt01.dev.ena.net$path opts "redirect=301"
route add http-redirect vlt02.dev.ena.net:80 https://vlt02.dev.ena.net$path opts "redirect=301"
route add http-redirect vlt03.dev.ena.net:80 https://vl203.dev.ena.net$path opts "redirect=301"

[meersau]

OK, for the moment I want to avoid write to the registry.consul.kvpath as long it works without it. What it does, if I add :443.

[aaronhurt]

Understood, I'm going to try to reproduce this and see what might be happening. Something else that could help. Could you start consul with TRACE log level and then run a request trace without the 443 port and see how it's actually matching.

https://github.com/fabiolb/fabio/wiki/Features#request-tracing

It sounds like you have a solution for now so I may not get to this for a bit ... but I'm going to keep the issue open so I don't forget.

[meersau]

Here the traces.
Just to be complete I started fabiolb with:
fabiolb -log.level TRACE -proxy.addr ":80,:443;cs=zertstore" -proxy.cs "cs=zertstore;type=consul;cert=http://localhost:8500/v1/kv/zerts"

Tags: urlprefix-web1.traefik/,urlprefix-web1.traefik:80/ redirect=301,https://web1.traefik/

2019/05/14 19:53:36 [TRACE] first Tracing web1.traefik/
2019/05/14 19:53:36 [TRACE] first Matching hosts: [web1.traefik web1.traefik:80]
2019/05/14 19:53:36 [TRACE] first Match web1.traefik/
2019/05/14 19:53:36 [TRACE] first Routing to service web1 on http://10.47.11.178:8081/

urlprefix-web1.traefik:443/,urlprefix-web1.traefik:80/ redirect=301,https://web1.traefik/

2019/05/14 19:55:50 [TRACE] second Tracing web1.traefik/
2019/05/14 19:55:50 [TRACE] second Matching hosts: [web1.traefik:80]
2019/05/14 19:55:50 [TRACE] second Match web1.traefik:80/
2019/05/14 19:55:50 [TRACE] second Routing to service web1 on https://web1.traefik/

[aaronhurt]

Thanks for the traces. It looks like it's not picking the most specific match on the first one. I think it should prefer the route with the specific port. I'll take a look at the route matcher.

[meersau]

@leprechau thanks.

[zakk4223]

I just ran into this too, but with a previously working config.
I did some docker image swapping: it works in 1.5.9, but not in 1.5.10

[tino]

Can confirm that this broke our http -> https redirects when upgrading from 1.5.9 to 1.5.11.

@leprechau any chance of a hotfix? Quite an important feature for us.