<div dir="ltr"><div>Maybe its a Chrome bug, but I have seen chrome connecting over ssl/spdy and setting the scheme: header to "http"</div><div><br></div><div><div>From the users point of view it is not visible that a ssl connection was used (no padlock icon etc), so I wanted a redirect to the https:// url (mainly to show to the user that it is https)</div>
<div><br></div></div><div>Using this to reproduce:</div><div><blockquote type="cite"><div dir="ltr"><div style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">server {</div><div style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">
<div> listen <a href="http://1.2.3.4:80">1.2.3.4:80</a>;</div></div><div style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px"><br></div><div style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">
location /foo {</div><div style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px"> return 301 <a href="https://mysite.com">https://mysite.com</a>$request_uri;</div><div style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">
<span style="font-family:arial;font-size:small;color:rgb(34,34,34)"> }</span></div><div style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px"><span style="font-family:arial;font-size:small;color:rgb(34,34,34)"><br>
</span></div><div style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px"><span style="font-family:arial;font-size:small;color:rgb(34,34,34)"> location / {</span></div><div><span style="color:rgb(34,34,34);font-family:arial;font-size:small"> a</span>dd_header Alternate-Protocol 443:npn-spdy/2;</div>
<div> </div><div> ...</div></div></blockquote><blockquote type="cite" style="font-size:13px;color:rgb(80,0,80);font-family:arial,sans-serif"><div dir="ltr"><div><span style="font-family:arial;font-size:small;color:rgb(34,34,34)"> } </span></div>
<div>}</div></div></blockquote></div><div><blockquote type="cite"><div dir="ltr"><div style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">server {</div><div style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">
<div> listen <a href="http://1.2.3.4:443/" target="_blank">1.2.3.4:443</a> ssl spdy;</div><div><br></div></div><div style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px"> location /foo {</div>
<div style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">
alias "/tmp/foo"; </div><div><font color="#500050" face="arial, sans-serif"> </font><span style="color:rgb(34,34,34);font-family:arial;font-size:small">}</span></div><div style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">
}</div><div style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px"><br></div><div style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">1. Empty browser cache</div><div style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">
2. Visit <a href="http://mysite.com">http://mysite.com</a> so that chrome learns of the alternate-protocol and will make next connection using spdy</div><div style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">
3. Now go to <a href="http://mysite.com/foo/a.html">http://mysite.com/foo/a.html</a></div><div style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px"><br></div><div style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">
Expected https:// in the location field. (Of course, the connection is over ssl/spdy port 443 when fetching /foo/a.html). Tested using Chrome <span style="color:rgb(48,57,66);font-family:'Lucida Grande',sans-serif;font-size:12px">32.0.1700.102</span></div>
<div style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px"><span style="color:rgb(48,57,66);font-family:'Lucida Grande',sans-serif;font-size:12px"><br></span></div><div><span style="color:rgb(48,57,66);font-family:'Lucida Grande',sans-serif;font-size:12px">I was testing also using spdylay (</span><font color="#303942" face="Lucida Grande, sans-serif"><span style="font-size:12px"><a href="https://github.com/tatsuhiro-t/spdylay">https://github.com/tatsuhiro-t/spdylay</a></span></font><span style="color:rgb(48,57,66);font-family:'Lucida Grande',sans-serif;font-size:12px">) where I can request with "http" scheme by using a url on the form <a href="http://mysite.com:443/foo/a.html">http://mysite.com:443/foo/a.html</a>.</span></div>
</div></blockquote></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Jan 30, 2014 at 7:48 AM, Igor Sysoev <span dir="ltr"><<a href="mailto:igor@sysoev.ru" target="_blank">igor@sysoev.ru</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div><div class="im"><div>On Jan 30, 2014, at 3:18 , Ragnar Rova wrote:</div><br><blockquote type="cite">
<div dir="ltr">Was a bit too quick with example, meant the 443 server does not have such a rewrite, that would mean a loop.<div><br></div><div><div style="font-family:arial,sans-serif;font-size:13px">server {</div><div style="font-family:arial,sans-serif;font-size:13px">
<div> listen <a href="http://1.2.3.4:443/" target="_blank">1.2.3.4:443</a> ssl spdy;</div><div><br></div></div><div style="font-family:arial,sans-serif;font-size:13px"> location / {</div><div style="font-family:arial,sans-serif;font-size:13px">
# this location is reachable using a http:// url when using spdy. If so, we want a redirect to the https:// url. How?</div><div style="font-family:arial,sans-serif;font-size:13px"> }</div><div style="font-family:arial,sans-serif;font-size:13px">
}</div></div></div></blockquote><div><br></div><div>server {</div><div> listen <a href="http://1.2.3.4:443" target="_blank">1.2.3.4:443</a> ssl spdy;</div><div><br></div><div> location / {</div></div><div> error_page 497 =301 <a href="https://mysite.com$request_uri" target="_blank">https://mysite.com$request_uri</a>;</div>
<div> ...</div><div> }</div><div><br></div><div><a href="http://nginx.org/en/docs/http/ngx_http_ssl_module.html#errors" target="_blank">http://nginx.org/en/docs/http/ngx_http_ssl_module.html#errors</a></div><div>
<a href="http://nginx.org/en/docs/http/ngx_http_core_module.html#error_page" target="_blank">http://nginx.org/en/docs/http/ngx_http_core_module.html#error_page</a></div>
<div><br></div><div>As to "http://" URLs over SPDY, this is impossible now since no browser support this.</div><span class="HOEnZb"><font color="#888888"><div><br></div><div><div style="word-wrap:break-word"><div style="word-wrap:break-word">
<div style="word-wrap:break-word"><span style="text-indent:0px;letter-spacing:normal;font-variant:normal;text-align:-webkit-auto;font-style:normal;font-weight:normal;line-height:normal;border-collapse:separate;text-transform:none;font-size:medium;white-space:normal;font-family:Georgia;word-spacing:0px"><div style="word-wrap:break-word">
<span style="text-indent:0px;letter-spacing:normal;font-variant:normal;font-style:normal;font-weight:normal;line-height:normal;border-collapse:separate;text-transform:none;font-size:medium;white-space:normal;font-family:Georgia;word-spacing:0px"><br>
-- <br>Igor Sysoev<br></span></div><div style="word-wrap:break-word"><span style="text-indent:0px;letter-spacing:normal;font-variant:normal;font-style:normal;font-weight:normal;line-height:normal;border-collapse:separate;text-transform:none;font-size:medium;white-space:normal;font-family:Georgia;word-spacing:0px"><a href="http://nginx.com" target="_blank">http://nginx.com</a></span></div>
</span></div></div></div></div></font></span><div><div class="h5"><br><div></div><br><blockquote type="cite"><div class="gmail_extra"><div class="gmail_quote">On Thu, Jan 30, 2014 at 12:16 AM, Ragnar Rova <span dir="ltr"><<a href="mailto:rr@mima.x.se" target="_blank">rr@mima.x.se</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr">
Sorry, my mistake, I was introducing a vulnerability by this.<div><br></div><div>So, without the patch, how do I setup the redirect from http to https urls when a http url was visited over spdy/tls?</div>
<div>
<br></div><div>I have</div><div><br></div><div>server {</div><div><div> listen <a href="http://1.2.3.4/" target="_blank">1.2.3.4:80</a>;</div><div><br></div><div> location ~ ^/(path1|path2)$ {</div><div> rewrite ^/(.*)$ <a href="https://mysite.com/$1" target="_blank">https://mysite.com/$1</a> permanent;</div>
</div><div> break;</div><div> }</div><div><br></div><div> location / {</div><div> add_header Alternate-Protocol 443:npn-spdy/2;</div><div> }</div><div> }</div><div>
<br>
</div><div><div><div>server {</div><div><div> listen <a href="http://1.2.3.4:443/" target="_blank">1.2.3.4:443</a> ssl spdy;</div><div><br></div><div> location ~ ^/(path1|path2)$ {</div><div> rewrite ^/(.*)$ <a href="https://mysite.com/$1" target="_blank">https://mysite.com/$1</a> permanent;</div>
</div><div> break;</div><div> }</div><div> </div><div> location / {</div><div> # this location is reachable using a http:// url when using spdy. If so, we want a redirect to the https:// url. How?</div>
<div> }</div><div>}</div></div></div></div><div><div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Jan 29, 2014 at 11:36 PM, Valentin V. Bartenev <span dir="ltr"><<a href="mailto:vbart@nginx.com" target="_blank">vbart@nginx.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>On Wednesday 29 January 2014 23:06:40 Ragnar Rova wrote:<br>
> # HG changeset patch<br>
> # User Ragnar Rova <<a href="mailto:ragnar.rova@gmail.com" target="_blank">ragnar.rova@gmail.com</a>><br>
> # Date 1391033075 -3600<br>
> # Wed Jan 29 23:04:35 2014 +0100<br>
> # Node ID 6654eae26c8b2a718e5ad116650faf37f7be7aa9<br>
> # Parent 01e2a5bcdd8f65f4f7bcb23ac35911da08e5945f<br>
> SPDY: set $scheme from scheme request header.<br>
><br>
> $scheme variable is always "https" when using spdy, existing code<br>
> just sets scheme to https based on if we are on a ssl connection.<br>
<br>
</div>Yes, and it is intentionally.<br>
<div><br>
> In spdy, there is a scheme header which should be used.<br>
<br>
</div>There is nothing special about spdy, the scheme also can be passed using<br>
request line in plain http or https, and nginx ignores it too.<br>
<div><br>
> Chrome uses http:// urls when establishing connections to sites using the<br>
> Alternate-Protocol header. If you want some locations to be visible<br>
> to the user as https, you can use $scheme in a http to https<br>
> redirect rule.<br>
<br>
</div>You can use it without this change. But the patch converts $scheme from<br>
a configuration restricted variable into an untrusted one (which can contain<br>
arbitrary value sent by client).<br>
<br>
wbr, Valentin V. Bartenev<br>
<br>
_______________________________________________<br>
nginx-devel mailing list<br>
<a href="mailto:nginx-devel@nginx.org" target="_blank">nginx-devel@nginx.org</a><br>
<a href="http://mailman.nginx.org/mailman/listinfo/nginx-devel" target="_blank">http://mailman.nginx.org/mailman/listinfo/nginx-devel</a><br>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div>
_______________________________________________<br>nginx-devel mailing list<br><a href="mailto:nginx-devel@nginx.org" target="_blank">nginx-devel@nginx.org</a><br><a href="http://mailman.nginx.org/mailman/listinfo/nginx-devel" target="_blank">http://mailman.nginx.org/mailman/listinfo/nginx-devel</a></blockquote>
</div></div></div><br></div><br>_______________________________________________<br>
nginx-devel mailing list<br>
<a href="mailto:nginx-devel@nginx.org">nginx-devel@nginx.org</a><br>
<a href="http://mailman.nginx.org/mailman/listinfo/nginx-devel" target="_blank">http://mailman.nginx.org/mailman/listinfo/nginx-devel</a><br></blockquote></div><br></div>