What is the difference between the HTTP → HTTPS frontend protocol option and the Redirect to HTTPS action?

Short answer

Both redirect an unencrypted incoming request to the HTTPS version of the same address. The HTTP → HTTPS frontend protocol option redirects all unencrypted traffic arriving at the IP:port of that frontend row with a fixed 301 code; since it applies only to unencrypted connections, it does not create a loop, and no exception can be defined. The Redirect to HTTPS action, on the other hand, can be limited with conditions (e.g. requests other than /api), and the redirect code can be selected; however, it does not include loop protection by itself, so it is used together with the ready-made If SSL is NOT terminated condition.

How Does It Work?

• Frontend protocol option: In the Protocol field of the row with port 80, HTTP → HTTPS in the Redirect group is selected. TR7 redirects every request arriving unencrypted at this IP:port to the same address (same Host, path and query) with https:// using 301. The redirect applies only to unencrypted connections arriving at the IP:port of this row; no condition can be added.
• Redirect to HTTPS action: It is created under Load Balancer → Actions and added to the Actions list of the vService. It runs only in the request stage. When the attached conditions are met, it redirects the request to the same address with https://; if no condition is attached, it applies to all requests arriving at the vService (including those arriving with HTTPS). To exclude requests arriving with HTTPS, the ready-made If SSL is NOT terminated condition is added.
• Execution order: Both methods are applied after the other request rules of the vService (actions, WAF, L7 DDoS & Threat Protection decisions); the position of the Redirect to HTTPS action in the Actions list does not change this.

Comparison

	Frontend: HTTP → HTTPS	Redirect to HTTPS action
Where it is set	vService → Frontend → Protocol	Load Balancer → Actions; vService → Details → Actions
Scope	All unencrypted traffic arriving at the IP:port of that row	Requests that match the conditions; if there is no condition, all requests
Redirect code	Fixed 301	Selected with Redirect Scheme Code (default 301; 301, 302, 303, 307 or 308 is used)
Loop protection	Yes; applies only to unencrypted connections	No; the If SSL is NOT terminated condition is added
Exception (e.g. excluding /api)	Cannot be defined	Defined with the NOT form of the conditions
Frontend row	The 80 row only redirects	The 80 row accepts requests with the HTTP (unencrypted) protocol; requests that are not redirected go to the Backend Service
vService type	HTTP	HTTP
HSTS	Does not add	Does not add

Which One Should I Use?

Your situation	Method
The whole site will be redirected to HTTPS	Frontend: HTTP → HTTPS
Some paths, clients or domains must stay unencrypted, or only these must be redirected	Redirect to HTTPS action + condition; see the example scenario
The redirect must be made with a different code such as 302, 307 or 308	Redirect to HTTPS action

For browsers to open the site directly with HTTPS on the next visit, the HSTS setting in the TLS Security Profile is turned on alongside the two methods.

Example Scenario: Redirecting Requests Other Than /api to HTTPS

All pages of the website will be redirected to HTTPS; however, the requests starting with /api from old API clients called with http:// will continue to be served unencrypted without being redirected. Since the HTTP → HTTPS option on the frontend cannot define an exception, this scenario is built with the Redirect to HTTPS action.

• How it works Port 80 accepts unencrypted requests. The Redirect to HTTPS action redirects to the https:// address only the requests that both arrive unencrypted and have a path that does not start with /api; /api requests are forwarded to the Backend Service on port 80.
• Where it is openedLoad Balancer → Conditions → Path; Load Balancer → Actions → Redirect to HTTPS; vService → Frontend and Details → Actions
• Requirement The vService IP must have been added to an interface; a certificate for 443
• vService type HTTP

1

Adım 1 Open the Path condition form

The Load Balancer → Conditions → Add steps are followed.

2

Adım 2 Define the /api condition

api-path is written to the Condition Name field; Path is selected as the Criteria. Regex is selected as the matching method, and ^/api(/|$) is written as the value. This expression matches /api, /api/ and /api/v1/orders; it does not match /apiary and /products. For a simpler definition, /api/ can also be used with Start (in this case, the exact /api path is redirected). Path matching is case-sensitive by default.

3

Adım 3 Save the condition

The Add button is clicked.

4

Adım 4 Open the action form and select the type

The Load Balancer → Actions → Add steps are followed; Redirect to HTTPS is selected as the Action Type. Redirect Scheme Code stays at the default 301.

5

Adım 5 Attach the conditions

In the Conditions field, two conditions are selected in the same group: the NOT form of the condition saved in step 3, which appears in the list as !api-path, and the ready-made If SSL is NOT terminated condition. The combination within the group stays and (default); thus the action runs only on requests that both arrive unencrypted and do not start with /api.

6

Adım 6 Save the action

The Add button is clicked.

7

Adım 7 Edit the frontend rows of the vService

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is opened. There are two rows in the Frontend table: in the Protocol field of the row with port 80, HTTP in the Unencrypted group is selected (HTTP → HTTPS is not selected; if it is selected, /api requests are also redirected), and in the row with port 443, HTTP/1.1 or HTTP/2 from the Encrypted (HTTPS) group and a certificate in the Certificate field are selected. If the vService IP is not in the list, it is first added to the interface with Network → Interfaces → Add IP.

8

Adım 8 Add the action to the vService

The action saved in step 6 is added to the Details → Actions list.

9

Adım 9 Save

The Save button is clicked.

1The site page is redirectedClient side

Commandcurl -I "http://www.example.com/urunler?sayfa=2"

ExpectedHTTP/1.1 301 · location: https://www.example.com/urunler?sayfa=2

2/api is not redirectedClient side

Commandcurl -I http://www.example.com/api/v1/orders

ExpectedThe response of the Backend Service (no 301)

HTTPS requests are not redirected either: curl -I https://www.example.com/ returns 200 directly. How many times the action ran is monitored by turning on Hit Counter in the action, in the vService Dashboard on the Action Hits tab.

Common Misconceptions

• "Adding Redirect to HTTPS without a condition is enough." An action without a condition also redirects requests arriving with HTTPS, and an infinite redirect loop occurs; the If SSL is NOT terminated condition is added.
• "While HTTP → HTTPS is selected on the frontend, I define an exception with an action." The frontend option redirects all requests on port 80; if an exception is needed, the 80 row is set to HTTP and the redirect is built with an action.
• "Using both together is safer." Both together create two separate redirect definitions; one is enough.
• "The redirect also adds HSTS." HSTS is a separate setting and is turned on from the TLS Security Profile.

How it is done in the documentation

• HTTP vService · Protocol
• Redirect to HTTPS · Redirect Scheme Code
• Redirect to HTTPS · Conditions
• Conditions · Automatic NOT (Negation) Condition Creation
• TLS Security Profiles · HSTS (Strict-Transport-Security header)

Related questions

• How do I redirect HTTP to HTTPS?
• Can the same vService listen on both port 80 and port 443?
• How do I add HSTS?
• An infinite redirect loop occurred; why?