☰

如何将 http 请求重定向到 https (nginx)

tag-icon • tag-icon nginx ssl https gitlab
如何将 http 请求重定向到 https (nginx)

似乎有很多问题和指南指导如何设置 nginx 以将 http 请求重定向到 https。许多都已过时，或者完全错误。

# MANAGED BY PUPPET

upstream gitlab {
  server unix:/home/git/gitlab/tmp/sockets/gitlab.socket;
}

# setup server with or without https depending on gitlab::gitlab_ssl variable
server {
  listen *:80;
  server_name gitlab.localdomain;
  server_tokens off;
  root /nowhere;
  rewrite ^ https://$server_name$request_uri permanent;
}
server {
  listen *:443 ssl default_server;
  server_name gitlab.localdomain;
  server_tokens off;
  root /home/git/gitlab/public;

  ssl                           on;
  ssl_certificate               /etc/ssl/certs/ssl-cert-snakeoil.pem;
  ssl_certificate_key           /etc/ssl/private/ssl-cert-snakeoil.key;
  ssl_protocols                 SSLv3 TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers                   AES:HIGH:!ADH:!MDF;
  ssl_prefer_server_ciphers     on;

  # individual nginx logs for this gitlab vhost
  access_log  /var/log/nginx/gitlab_access.log;
  error_log   /var/log/nginx/gitlab_error.log;

  location / {
    # serve static files from defined root folder;.
    # @gitlab is a named location for the upstream fallback, see below
    try_files $uri $uri/index.html $uri.html @gitlab;
  }

  # if a file, which is not found in the root folder is requested,
  # then the proxy pass the request to the upsteam (gitlab puma)
  location @gitlab {
    proxy_read_timeout 300; # https://github.com/gitlabhq/gitlabhq/issues/694
    proxy_connect_timeout 300; # https://github.com/gitlabhq/gitlabhq/issues/694
    proxy_redirect     off;

    proxy_set_header   X-Forwarded-Proto $scheme;
    proxy_set_header   X-Forwarded-Ssl   on;

    proxy_set_header   Host              $http_host;
    proxy_set_header   X-Real-IP         $remote_addr;

    proxy_pass http://gitlab;
  }
}

每次更改配置后我都会重新启动，但访问时仍然只会显示“欢迎使用 nginx”页面http://192.168.33.10。然而，它https://192.168.33.10运行良好。

为什么 nginx 仍然不会将 http 请求重定向到 https？

我也尝试过以下配置

  listen *:80;
  server_name <%= @fqdn %>;
  #root /nowhere; 
  #rewrite ^ https://$server_name$request_uri? permanent; 
  #rewrite ^ https://$server_name$request_uri permanent;
  #return 301 https://$server_name$request_uri;
  #return 301 http://$server_name$request_uri;
  #return 301 http://192.168.33.10$request_uri;
  return 301 http://$host$request_uri;

日志

tailf /var/log/nginx/access.log
192.168.33.1 - - [22/Oct/2013:03:41:39 +0000] "GET / HTTP/1.1" 304 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0"
192.168.33.1 - - [22/Oct/2013:03:44:43 +0000] "GET / HTTP/1.1" 200 133 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0"

tailf /var/log/nginx/gitlab_error.lob
2013/10/22 02:29:14 [crit] 27226#0: *1 connect() to unix:/home/git/gitlab/tmp/sockets/gitlab.socket failed (2: No such file or directory) while connecting to upstream, client: 192.168.33.1, server: gitlab.localdomain, request: "GET / HTTP/1.1", upstream: "http://unix:/home/git/gitlab/tmp/sockets/gitlab.socket:/", host: "192.168.33.10"

资源
https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
如何使 nginx 重定向
如何在 nginx 中强制或重定向到 SSL？
nginx SSL 重定向
Nginx 和 Https 重定向
https://www.tinywp.in/301-redirect-wordpress/
如何在 nginx 中强制或重定向到 SSL？

答案1

我已发现问题了。

我在 /etc/hosts 中有一个条目配置错误

127.0.0.1 gitlab.localdomain gitlab

当我将其更改为以下内容时，https 重定向开始起作用

192.168.33.10 gitlab.localdomain gitlab

总而言之，这是有效的语法。

server {
  listen 80;
  server_name gitlab.localdomain;
  server_tokens off;
  return 301 https://$host$request_uri;


}
server {
  listen 443 ssl default_server;
  server_name gitlab.localdomain;
  server_tokens off;
  root /home/git/gitlab/public;
  ssl                           on;
  ssl_certificate               /etc/ssl/certs/ssl-cert-snakeoil.pem;
  ssl_certificate_key           /etc/ssl/private/ssl-cert-snakeoil.key;
  ssl_protocols                 SSLv3 TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers                   AES:HIGH:!ADH:!MDF;
  ssl_prefer_server_ciphers     on;
…

笔记
重定向仅在通过名称调用 URL 时有效，如果导航到 IP，则不会重定向。

答案2

关于如何确保 http 到 https 重定向的 2 件事

  • 在您的 HTTPS - 部分中，启用HSTS 标头_> 这将确保您的浏览器仅以 HTTPS 发送未来的请求

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";

  • 在您的 http 部分中：您可以return 301 https://$server_name$request_uri;（最快的方法）或重写（较慢）

    server {
  listen 80;
  server_name _;
  server_tokens off;

  return 301 https://$host$request_uri;

    }

相关内容