HTTP to HTTPS redirect in Nginx - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Configuration

intermediate

Basic HTTP to HTTPS Redirect Configuration

Which nginx server block configuration correctly redirects all HTTP requests to HTTPS?

Nginx

server {
    listen 80;
    server_name example.com www.example.com;

    # Redirect rule here
}

A return 301 https://$host$request_uri;

B proxy_pass https://$host$request_uri;

C rewrite ^ https://$host$request_uri permanent;

D error_page 301 https://$host$request_uri;

💡 Hint

Use a simple return directive for permanent redirect in nginx.

The return 301 https://$host$request_uri; directive sends a permanent redirect to the client, telling it to use HTTPS. The rewrite directive can also redirect but is more complex and less efficient here. proxy_pass is for forwarding requests, not redirecting. error_page is for error handling, not redirects.

💻 Command Output

intermediate

Output of curl Command for HTTP Redirect

You run the command curl -I http://example.com against an nginx server configured to redirect HTTP to HTTPS. What is the expected HTTP status code in the response headers?

A HTTP/1.1 301 Moved Permanently

B HTTP/1.1 500 Internal Server Error

C HTTP/1.1 404 Not Found

D HTTP/1.1 200 OK

💡 Hint

Permanent redirects use status code 301.

The curl -I command fetches headers only. When nginx redirects HTTP to HTTPS, it sends a 301 Moved Permanently status code to tell the client to use the HTTPS URL.

❓ Troubleshoot

advanced

Why is HTTP to HTTPS Redirect Not Working?

An nginx server block is configured to redirect HTTP to HTTPS, but when accessing http://example.com, the browser does not redirect and shows the HTTP content instead. Which is the most likely cause?

Nginx

server {
    listen 80;
    server_name example.com;
    # redirect missing or incorrect
}

server {
    listen 443 ssl;
    server_name example.com;
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;
    # HTTPS content
}

A The server_name directive is missing in the HTTPS block.

B The HTTP server block is missing the redirect directive.

C The HTTPS server block should listen on port 80.

D The SSL certificate is expired, so redirect fails.

💡 Hint

Check if the HTTP block actually tells nginx to redirect.

If the HTTP server block does not have a redirect directive, nginx will serve HTTP content normally without redirecting. SSL certificate issues or server_name missing in HTTPS block do not affect HTTP redirect. HTTPS block listening on port 80 is incorrect.

🔀 Workflow

advanced

Order of Steps to Enable HTTP to HTTPS Redirect in nginx

Arrange the steps in the correct order to enable HTTP to HTTPS redirect on an nginx server.

A 3,1,2,4

B 1,3,2,4

C 2,1,3,4

D 1,2,3,4

💡 Hint

Think about what must be done before configuring SSL and redirects.

First, you must have a valid SSL certificate (step 1). Then configure the HTTP block to redirect (step 2) and the HTTPS block with SSL (step 3). Finally, reload nginx to apply changes (step 4).

✅ Best Practice

expert

Best Practice for Handling www and non-www Redirects with HTTPS

You want to redirect all HTTP and HTTPS requests to the HTTPS version with www.example.com. Which nginx configuration snippet correctly implements this best practice?

A

server {
    listen 80;
    server_name example.com;
    return 301 https://example.com$request_uri;
}

server {
    listen 443 ssl;
    server_name www.example.com;
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;
    # main site content
}

B

server {
    listen 80;
    server_name www.example.com;
    return 301 https://www.example.com$request_uri;
}

server {
    listen 443 ssl;
    server_name example.com www.example.com;
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;
    # main site content
}

C

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://www.example.com$request_uri;
}

server {
    listen 443 ssl;
    server_name example.com;
    return 301 https://www.example.com$request_uri;
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;
}

server {
    listen 443 ssl;
    server_name www.example.com;
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;
    # main site content
}

D

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name example.com www.example.com;
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;
    # main site content
}

💡 Hint

Redirect all variants to a single canonical HTTPS domain with www.

Option C redirects all HTTP requests and HTTPS requests for example.com to https://www.example.com. This ensures a single canonical URL with HTTPS and www. Other options either do not redirect non-www HTTPS or redirect to non-www HTTPS, which is not the best practice here.

Practice

1. What is the main purpose of configuring an HTTP to HTTPS redirect in nginx?

easy

A. To allow both HTTP and HTTPS traffic without changes

B. To block all HTTP traffic permanently

C. To automatically send users from an insecure HTTP site to a secure HTTPS site

D. To disable HTTPS and use only HTTP

Solution

1. Step 1: Understand HTTP and HTTPS roles

   HTTP is not secure, HTTPS encrypts data for safety.

2. Step 2: Purpose of redirect

   Redirecting HTTP to HTTPS ensures users always use the secure version.

3. Final Answer:

   To automatically send users from an insecure HTTP site to a secure HTTPS site -> Option C

4. Quick Check:

   Redirect HTTP to HTTPS = Secure site [OK]

Hint: Redirect HTTP to HTTPS to secure user connections [OK]

Common Mistakes:

• Thinking redirect blocks HTTP instead of forwarding
• Believing HTTPS disables HTTP completely
• Confusing redirect with allowing both protocols

2. Which nginx configuration snippet correctly redirects all HTTP requests to HTTPS?

easy

A. server { listen 80; rewrite ^ https://$host$uri permanent; }

B. server { listen 443 ssl; return 301 http://$host$request_uri; }

C. server { listen 80; proxy_pass https://$host$request_uri; }

D. server { listen 80; return 301 https://$host$request_uri; }

Solution

1. Step 1: Identify correct listen port and redirect method

   HTTP listens on port 80; redirect uses 'return 301' for permanent redirect.

2. Step 2: Check syntax correctness

   server { listen 80; return 301 https://$host$request_uri; } uses 'listen 80' and 'return 301 https://$host$request_uri;' which is correct syntax.

3. Final Answer:

   server { listen 80; return 301 https://$host$request_uri; } -> Option D

4. Quick Check:

   Port 80 + return 301 + https URL = Correct redirect [OK]

Hint: Use 'listen 80' and 'return 301 https://$host$request_uri;' [OK]

Common Mistakes:

• Using 'listen 443' for HTTP redirect
• Using 'proxy_pass' instead of 'return 301'
• Incorrect rewrite syntax causing errors

3. Given this nginx server block, what will happen when a user visits http://example.com/page?

server {
  listen 80;
  server_name example.com;
  return 301 https://$host$request_uri;
}

medium

A. The user will see the HTTP version of the page without redirection

B. The user will be redirected to https://example.com/page with a permanent redirect

C. The server will return a 404 error

D. The server will proxy the request to HTTPS without changing the URL

Solution

1. Step 1: Analyze the server block

   It listens on port 80 (HTTP) and returns a 301 redirect to HTTPS version of the requested URI.

2. Step 2: Understand the redirect effect

   User visiting http://example.com/page will be sent a permanent redirect to https://example.com/page.

3. Final Answer:

   The user will be redirected to https://example.com/page with a permanent redirect -> Option B

4. Quick Check:

   HTTP request + return 301 to HTTPS = Redirect [OK]

Hint: Return 301 sends permanent redirect to HTTPS URL [OK]

Common Mistakes:

• Assuming no redirect happens
• Confusing proxy_pass with redirect
• Expecting error instead of redirect

4. You wrote this nginx config to redirect HTTP to HTTPS but it does not work:

server {
  listen 80;
  server_name example.com;
  rewrite ^ https://$host$uri permanent;
}

What is the likely problem?

medium

A. The rewrite directive should be replaced with 'return 301 https://$host$request_uri;'

B. The rewrite directive is missing a semicolon

C. The listen port should be 443 for HTTPS

D. The server_name directive is incorrect

Solution

1. Step 1: Check rewrite vs return usage

   While rewrite can redirect, using 'return 301' is simpler and more reliable for HTTP to HTTPS redirects.

2. Step 2: Identify best practice

   Replacing rewrite with 'return 301 https://$host$request_uri;' fixes the redirect issue.

3. Final Answer:

   The rewrite directive should be replaced with 'return 301 https://$host$request_uri;' -> Option A

4. Quick Check:

   Use 'return 301' for clean HTTP to HTTPS redirect [OK]

Hint: Use 'return 301' instead of rewrite for HTTPS redirect [OK]

Common Mistakes:

• Thinking missing semicolon causes failure
• Changing listen port to 443 for HTTP redirect
• Assuming server_name is the problem

5. You want to redirect HTTP to HTTPS but only for the domain secure.example.com, leaving other domains on HTTP. Which nginx config snippet achieves this?

hard

A. server { listen 80; server_name secure.example.com; return 301 https://$host$request_uri; }

B. server { listen 80 default_server; return 301 https://$host$request_uri; }

C. server { listen 443 ssl; server_name secure.example.com; return 301 http://$host$request_uri; }

D. server { listen 80; server_name _; return 301 https://$host$request_uri; }

Solution

1. Step 1: Match only the desired domain

   Using 'server_name secure.example.com;' limits redirect to that domain only.

2. Step 2: Redirect HTTP on port 80 to HTTPS

   Listening on port 80 and returning 301 redirect to HTTPS URL ensures only that domain redirects.

3. Final Answer:

   server { listen 80; server_name secure.example.com; return 301 https://$host$request_uri; } -> Option A

4. Quick Check:

   Specific server_name + return 301 = domain-only redirect [OK]

Hint: Use server_name to limit redirect to one domain [OK]

Common Mistakes:

• Using default_server redirects all domains
• Redirecting on port 443 instead of 80
• Using wildcard server_name '_' incorrectly