X-Forwarded-Proto for rails for nginx for ELB

Question

I was pretty stuck with this thing a couple of hours. I could not get it to work. I tried everything I could think of and / or find on the Internet.

So my application is pointed to ELB (web). The ELB listens to 80 and 443 and sends traffic up to 80 (SSL terminates here) to the member instance, which is nginx.

Nginx proxies application requests to another ELB (application) in front of multiple instances. These instances trigger the cougar.

Everything works fine, except when I try to visit the URL (where I used force_ssl for this controller) using the https scheme, I get a redirect loop.

Here are my nginx configurations look like

  location @{{app_name}} { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $http_host; proxy_set_header X-Forwarded-Proto $scheme; proxy_redirect off; proxy_pass http://{{app_name}}; # limit_req zone=one; access_log /var/log/nginx/access.log; error_log /var/log/nginx/error.log; } 

(Obviously, app_name is being replaced by ansible.)

Instead of $scheme I tried hardcoding https and $proxy_add_x_forwarded_proto , but no one worked for me. I am still getting a loop.

Then I started checking env on rails and I see the following values ​​regardless of the header set in nginx configuration.

 "SERVER_PROTOCOL"=>"HTTP/1.1", "HTTP_X_FORWARDED_PROTO"=>"http", "rack.url_scheme"=>"http", 

I'm not sure what I'm doing wrong. Any help appreciated! Note. I already checked all the found SO streams and no one helped!

Answer 1

I found a solution that works (although I'm not sure if this is correct).

So, if I configure the TCP listener to 8080: 8080 and use this from the upstream nginx settings, everything works fine. This means that web instances are connecting to the ELB app on TCP 8080. I see that X-Forwarded-Proto is transmitted correctly.

I also added a listener to 80, as this ELB is used as the start of a cloud mode that connects to 80.

Answer 2

In the case of SSL offloading, it makes sense to communicate through simple HTTP (80) and configure the rails:

configurations / environment / production.rb

 config.force_ssl = false 

This helps to avoid the redirect cycle and never use HTTPS inside load balancing and the Nginx application server.

You also mentioned:

where i used force_ssl for this controller

Please use HTTPS everywhere on the website and redirect 80-> 443 to ELB level.