The backend application generates http:// in absolute URLs; how do I fix it?

Short answer

Since the application does not know that TLS is terminated on TR7, it generates links and redirects with http://; TR7 does not pass this information on its own. The permanent solution is to add the X-Forwarded-Proto: https header with the Set HTTP Header action (Execution Level = On request, Conditions = If SSL is terminated) and to configure the application to trust this header. If the application cannot be changed, the Location header in redirects is rewritten as https:// with the Replace HTTP Header Content action, and the links inside the page are changed with Modify Response Content. If the Backend Service supports TLS, SSL Service can also be turned on so that the application sees the request directly as HTTPS. Actions work only when they are added to the vService.

Problem: The Application Generates http:// Links on an HTTPS Site

Since TLS is terminated on TR7, the request going to the Backend Service is unencrypted by default; the application assumes the request is HTTP and generates http:// addresses in redirects and pages. This leads to mixed content warnings, redirect loops (An infinite redirect loop occurred; why?) and session loss because Secure cookies are not sent (My application keeps sending users back to the login screen (the session is lost); why?). TR7 does not add a header that reports the original protocol of the request to the Backend Service on its own.

Solution: Four Methods

The methods are alternatives to each other; if the application can read the proxy header, Method 1 alone is enough. If the application cannot be changed, Method 2 and Method 3 can be used together.

Your situation	Suitable method
The application can read the proxy header	Method 1: X-Forwarded-Proto
The application cannot be changed, the problem is in redirects	Method 2: Rewriting Location
The application cannot be changed, the problem is in the links inside the page	Method 3: Modify Response Content
The Backend Service can listen with TLS	Method 4: SSL service

Method 1: X-Forwarded-Proto Recommended

• How it works TR7 adds the X-Forwarded-Proto: https header to requests that arrive over HTTPS; the application generates https:// addresses based on this header.
• Where it is openedLoad Balancer → Actions → Set HTTP Header; then vService → Actions
• Requirement Configuring the application or the web server to trust proxy headers
• vService type HTTP
• Backend Service side The "forwarded headers" or "trusted proxy" setting is turned on in the application, and the address of TR7 is defined as a trusted proxy.

Step-by-Step Configuration

1

Adım 1 Open the action add form

On the Load Balancer → Actions screen, the Add button is clicked.

2

Adım 2 Enter the action type and the header

Action Type = Set HTTP header, Execution Level = On request, Header to Edit = X-Forwarded-Proto, Header Content = https are entered.

3

Adım 3 Select the condition

In the Conditions field, the ready-made If SSL is terminated condition is selected; this way, the header is added only to requests that arrive over HTTPS.

4

Adım 4 Add the action

The Add button is clicked.

5

Adım 5 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and the Edit button is clicked.

6

Adım 6 Add the action to the vService

Details is opened; the Actions box is checked and the created action is selected in the field that opens. The action does not work unless it is added to the vService.

7

Adım 7 Save

The Save button is clicked. Then the setting for trusting proxy headers is turned on in the application; this setting is outside TR7.

If port 80 on the same vService does not perform an HTTP → HTTPS redirect and also responds to unencrypted requests, an X-Forwarded-Proto: https header sent by the client itself can reach the application. To prevent this, a second Set HTTP Header action with the If SSL is NOT terminated condition, created with the same steps, sets the X-Forwarded-Proto value to http.

Verification

1RedirectClient side

An address that performs a redirect is requested: curl -sI https://www.example.com/giris

ExpectedLocation: https://…

2Outgoing headerTR7 side

While the vService is in Debug mode, the headers of the record are checked in the Debug Mode Logs → Request tab.

ExpectedX-Forwarded-Proto: https · with the added header mark

Method 2: Rewriting Location

• How it works In the response stage, the http:// address in the Location header is rewritten as https:// with a regular expression.
• Where it is openedLoad Balancer → Actions → Replace HTTP Header Content; then vService → Actions
• Requirement No change is required in the application.
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the action add form

On the Load Balancer → Actions screen, the Add button is clicked.

2

Adım 2 Enter the action type and the rewrite rule

Action Type = Replace HTTP Header Content, Execution Level = On response, Header to Replace = Location, Regex to Match = ^http://(.*)$, Match Type = Replace whole header, Replacement Content = https://\1 are entered. If the application generates an internal name and port, the pattern is written accordingly: Regex to match = ^http://ic-sunucu:8080/(.*)$, Replacement Content = https://www.example.com/\1. Replacement content does not support Smart Variables; the captured group is written in the \1 form.

3

Adım 3 Add the action

The Add button is clicked.

4

Adım 4 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and the Edit button is clicked.

5

Adım 5 Add the action to the vService

Details is opened; the Actions box is checked and the created action is selected in the field that opens.

6

Adım 6 Save

The Save button is clicked.

Verification

1RedirectClient side

The address that performs a redirect is requested: curl -sI https://www.example.com/giris

ExpectedLocation: https://…

Method 3: Modify Response Content

• How it works The http:// links in the response body are changed to https:// with the Replace mode.
• Where it is openedLoad Balancer → Actions → Modify Response Content; then vService → Actions
• Requirement No change is required in the application.
• vService type HTTP
• Effect As long as the action is on the vService, responses are requested uncompressed from the Backend Service.

Step-by-Step Configuration

1

Adım 1 Open the action add form

On the Load Balancer → Actions screen, the Add button is clicked.

2

Adım 2 Select the Replace mode and enter the values

Action Type = Modify Response Content, Modify Type = Replace, Query Type = String, Mask Query = http://, New Content = https:// are entered. The Query type default is RegEx.

3

Adım 3 Select the condition

In the Conditions field, a condition that selects only HTML responses (the Content-Type header contains text/html) is selected; if no condition is selected, the action is applied to all responses.

4

Adım 4 Add the action

The Add button is clicked.

5

Adım 5 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and the Edit button is clicked.

6

Adım 6 Add the action to the vService

Details is opened; the Actions box is checked and the created action is selected in the field that opens.

7

Adım 7 Save

The Save button is clicked. Detailed options for resources inside the page: After switching to HTTPS, pages show a "mixed content" warning; how do I fix it?

Verification

1PageClient side

The links in the page source are checked in the browser.

Expectedhttps:// links

Method 4: SSL Service

• How it works TR7 connects to the Backend Service with TLS; the application sees the request directly as HTTPS.
• Where it is openedLoad Balancer → Backend Services → SSL Service
• Requirement The Backend Service listening with TLS (e.g. on port 443 with a certificate)
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the Backend Service edit form

On the Load Balancer → Backend Services screen, the Backend Service is selected and the Edit button is clicked.

2

Adım 2 Turn on SSL Service

SSL Service is checked; if the Backend Service listens for TLS on another port, the Port field is set to that port (e.g. 443). Details of the option: What does the SSL Service option do; what is needed to connect to the backend over an encrypted connection?

3

Adım 3 Save

The Edit button at the bottom of the form is clicked.

Verification

1RedirectClient side

The address that performs a redirect is requested: curl -sI https://www.example.com/giris

ExpectedLocation: https://…

Common Mistakes

• Adding the header and not configuring the application. The behavior does not change unless the application trusts the header.
• Writing $1 or a Smart Variable in Replacement content. Replacement content accepts only fixed text and a group reference in the \1 form.
• Using \1 in Modify response content. New content is plain text; in RegEx mode as well, a back-reference passes to the output as it is written.
• Assuming that CSP upgrade-insecure-requests will fix redirects. This method upgrades only resources inside the page; it does not change the Location header.
• Relying only on the HTTP → HTTPS redirect of TR7 without fixing Location. An https → http → https chain occurs (An infinite redirect loop occurred; why?).
• Forgetting to add the action to the vService. An action created on the Actions screen does not work unless it is added to the Actions field of the vService (Why is my Action not triggering?).

How it is done in the documentation

• Set HTTP Header · Scenario 2: Forwarding the Protocol Information After SSL Offloading
• Replace HTTP Header Content · Scenario 1: Converting the Redirect URL from HTTP to HTTPS
• Modify Response Content · Scenario 3: Replace Mode: Converting the HTTP Links of a Legacy Application to HTTPS
• Backend Services · SSL Service

Related questions

• After switching to HTTPS, pages show a "mixed content" warning; how do I fix it?
• An infinite redirect loop occurred; why?
• My application keeps sending users back to the login screen (the session is lost); why?