HTTP to HTTPS redirect in Nginx - Step-by-Step Execution

Process Flow - HTTP to HTTPS redirect

Client sends HTTP request

↓

Nginx listens on port 80

↓

Check if request is HTTP

Yes↓

Send 301 redirect to HTTPS URL

↓

Client receives redirect and sends HTTPS request

↓

Secure connection established

The server listens for HTTP requests and responds with a redirect to the HTTPS version, prompting the client to reconnect securely.

Execution Sample

Nginx

server {
    listen 80;
    server_name example.com;
    return 301 https://$host$request_uri;
}

This nginx config listens on HTTP port 80 and redirects all requests to the HTTPS version of the same URL.

Process Table

Step	Client Request	Nginx Action	Response Sent	Client Action
1	HTTP GET http://example.com/page	Check if request is HTTP	301 Redirect to https://example.com/page	Receives redirect
2	HTTPS GET https://example.com/page	Serve HTTPS content (not shown here)	200 OK with content	Displays secure page
3	N/A	N/A	N/A	Process ends
Exit	N/A	No more HTTP requests	N/A	Secure connection established

💡 After redirect, client uses HTTPS; HTTP request handling ends.

Status Tracker

Variable	Start	After Step 1	After Step 2	Final
$host	example.com	example.com	example.com	example.com
$request_uri	/page	/page	/page	/page

Key Moments - 3 Insights

Why does nginx send a 301 redirect instead of serving content on HTTP?

Because the config explicitly returns a 301 redirect for all HTTP requests (see execution_table step 1), forcing clients to use HTTPS.

What happens if the client ignores the redirect?

The client will not get the secure content and stays on HTTP, which is not secure. The redirect is a signal to switch to HTTPS (execution_table step 1).

Why do we use $host and $request_uri in the redirect?

They preserve the original domain and path so the client is redirected to the exact same page but with HTTPS (see variable_tracker).

Visual Quiz - 3 Questions

Look at the execution table, what response does nginx send to the HTTP request at step 1?

A 200 OK with content

B 404 Not Found

C 301 Redirect to HTTPS URL

D 500 Internal Server Error

💡 Hint

Check the 'Response Sent' column in execution_table row for step 1.

At which step does the client send the HTTPS request?

A Step 2

B Step 3

C Step 1

D Exit

💡 Hint

Look at the 'Client Request' column in execution_table for HTTPS requests.

If we remove the 'return 301' line from the config, what happens to HTTP requests?

A They get redirected to HTTPS anyway

B Nginx serves HTTP content without redirect

C Nginx returns 404 error

D Nginx crashes

💡 Hint

The redirect is explicitly caused by 'return 301' in the config shown in execution_sample.

Concept Snapshot

nginx HTTP to HTTPS redirect:
- Listen on port 80 for HTTP
- Use 'return 301 https://$host$request_uri;' to redirect
- Sends permanent redirect to HTTPS URL
- Client then requests HTTPS URL
- Ensures secure connection by forcing HTTPS

Full Transcript

This visual execution shows how nginx redirects HTTP requests to HTTPS. When a client sends an HTTP request to port 80, nginx checks the request and responds with a 301 redirect to the same URL but with HTTPS. The client then follows this redirect and sends a new request over HTTPS. This process ensures all traffic uses a secure connection. Variables $host and $request_uri keep the domain and path unchanged during redirect. Without the redirect, nginx would serve HTTP content directly, which is less secure.

Practice

1. What is the main purpose of configuring an HTTP to HTTPS redirect in nginx?

easy

A. To allow both HTTP and HTTPS traffic without changes

B. To block all HTTP traffic permanently

C. To automatically send users from an insecure HTTP site to a secure HTTPS site

D. To disable HTTPS and use only HTTP

Solution

1. Step 1: Understand HTTP and HTTPS roles

   HTTP is not secure, HTTPS encrypts data for safety.

2. Step 2: Purpose of redirect

   Redirecting HTTP to HTTPS ensures users always use the secure version.

3. Final Answer:

   To automatically send users from an insecure HTTP site to a secure HTTPS site -> Option C

4. Quick Check:

   Redirect HTTP to HTTPS = Secure site [OK]

Hint: Redirect HTTP to HTTPS to secure user connections [OK]

Common Mistakes:

• Thinking redirect blocks HTTP instead of forwarding
• Believing HTTPS disables HTTP completely
• Confusing redirect with allowing both protocols

2. Which nginx configuration snippet correctly redirects all HTTP requests to HTTPS?

easy

A. server { listen 80; rewrite ^ https://$host$uri permanent; }

B. server { listen 443 ssl; return 301 http://$host$request_uri; }

C. server { listen 80; proxy_pass https://$host$request_uri; }

D. server { listen 80; return 301 https://$host$request_uri; }

Solution

1. Step 1: Identify correct listen port and redirect method

   HTTP listens on port 80; redirect uses 'return 301' for permanent redirect.

2. Step 2: Check syntax correctness

   server { listen 80; return 301 https://$host$request_uri; } uses 'listen 80' and 'return 301 https://$host$request_uri;' which is correct syntax.

3. Final Answer:

   server { listen 80; return 301 https://$host$request_uri; } -> Option D

4. Quick Check:

   Port 80 + return 301 + https URL = Correct redirect [OK]

Hint: Use 'listen 80' and 'return 301 https://$host$request_uri;' [OK]

Common Mistakes:

• Using 'listen 443' for HTTP redirect
• Using 'proxy_pass' instead of 'return 301'
• Incorrect rewrite syntax causing errors

3. Given this nginx server block, what will happen when a user visits http://example.com/page?

server {
  listen 80;
  server_name example.com;
  return 301 https://$host$request_uri;
}

medium

A. The user will see the HTTP version of the page without redirection

B. The user will be redirected to https://example.com/page with a permanent redirect

C. The server will return a 404 error

D. The server will proxy the request to HTTPS without changing the URL

Solution

1. Step 1: Analyze the server block

   It listens on port 80 (HTTP) and returns a 301 redirect to HTTPS version of the requested URI.

2. Step 2: Understand the redirect effect

   User visiting http://example.com/page will be sent a permanent redirect to https://example.com/page.

3. Final Answer:

   The user will be redirected to https://example.com/page with a permanent redirect -> Option B

4. Quick Check:

   HTTP request + return 301 to HTTPS = Redirect [OK]

Hint: Return 301 sends permanent redirect to HTTPS URL [OK]

Common Mistakes:

• Assuming no redirect happens
• Confusing proxy_pass with redirect
• Expecting error instead of redirect

4. You wrote this nginx config to redirect HTTP to HTTPS but it does not work:

server {
  listen 80;
  server_name example.com;
  rewrite ^ https://$host$uri permanent;
}

What is the likely problem?

medium

A. The rewrite directive should be replaced with 'return 301 https://$host$request_uri;'

B. The rewrite directive is missing a semicolon

C. The listen port should be 443 for HTTPS

D. The server_name directive is incorrect

Solution

1. Step 1: Check rewrite vs return usage

   While rewrite can redirect, using 'return 301' is simpler and more reliable for HTTP to HTTPS redirects.

2. Step 2: Identify best practice

   Replacing rewrite with 'return 301 https://$host$request_uri;' fixes the redirect issue.

3. Final Answer:

   The rewrite directive should be replaced with 'return 301 https://$host$request_uri;' -> Option A

4. Quick Check:

   Use 'return 301' for clean HTTP to HTTPS redirect [OK]

Hint: Use 'return 301' instead of rewrite for HTTPS redirect [OK]

Common Mistakes:

• Thinking missing semicolon causes failure
• Changing listen port to 443 for HTTP redirect
• Assuming server_name is the problem

5. You want to redirect HTTP to HTTPS but only for the domain secure.example.com, leaving other domains on HTTP. Which nginx config snippet achieves this?

hard

A. server { listen 80; server_name secure.example.com; return 301 https://$host$request_uri; }

B. server { listen 80 default_server; return 301 https://$host$request_uri; }

C. server { listen 443 ssl; server_name secure.example.com; return 301 http://$host$request_uri; }

D. server { listen 80; server_name _; return 301 https://$host$request_uri; }

Solution

1. Step 1: Match only the desired domain

   Using 'server_name secure.example.com;' limits redirect to that domain only.

2. Step 2: Redirect HTTP on port 80 to HTTPS

   Listening on port 80 and returning 301 redirect to HTTPS URL ensures only that domain redirects.

3. Final Answer:

   server { listen 80; server_name secure.example.com; return 301 https://$host$request_uri; } -> Option A

4. Quick Check:

   Specific server_name + return 301 = domain-only redirect [OK]

Hint: Use server_name to limit redirect to one domain [OK]

Common Mistakes:

• Using default_server redirects all domains
• Redirecting on port 443 instead of 80
• Using wildcard server_name '_' incorrectly