Redirect HTTP to HTTPS in OpenResty Edge: 301 Page Rule to Enforce SSL

To redirect HTTP to HTTPS in OpenResty Edge, create a page rule whose condition matches the Scheme variable against http, then add a Redirect action that keeps the current URI and query string, switches the scheme to https, and returns 301 (Moved Permanently). Releasing the rule pushes it to every gateway cluster with no server reload.

Your site already has its certificate installed — whether you issued it free via Let’s Encrypt, uploaded your own SSL certificate, or automated issuance and renewal over ACME — and this rule is what makes SSL mandatory. Below we build the rule in the Edge Admin console step by step, then verify it with curl.

Create a Page Rule to Redirect All HTTP Requests to HTTPS

As always, let’s go to the OpenResty Edge’s Admin web console. This is our sample deployment of the console. Every user has her own local deployment.

This time we use our continuing sample application for the test-edge.com domain.

Let’s enter this application.

Let’s go to the page rules.

Create a new page rule.

We enable a rule condition for all HTTP requests.

Let’s see all the variables we can choose from.

We select Scheme.

We keep the string equality operator intact.

We choose http as the value.

The condition is now complete. It is matching all HTTP requests and excluding any HTTPS ones.

Then for the action part of the rule, we can configure a 301 redirect action.

We have a lot of actions here.

So better search for the Redirect action.

Select it.

We keep the current request URI intact.

And we also inherit the current request’s URI arguments or query string.

We need to change the request scheme of the new request though.

We select https.

We can select 301 redirect instead here.

It is the Moved Permanently redirect type.

We make sure this rule runs before any existing normal rules.

Make sure we skip any subsequent rules when this rule is matched.

It’s not really necessary for this rule. But it is always a good idea to be explicit when we want to immediately stop request processing.

Create this rule for real.

We can see our new page rule to redirect all HTTP requests to their HTTPS counterparts.

Release the 301 Redirect Rule to All Gateway Clusters

We need to make a new release to push out our new page rule, as always. Releases in OpenResty Edge come with version control and one-click rollback, so a redirect rule can be reverted as easily as it is shipped.

Click on this button.

Ship it!

It is fully synchronized.

Now the new page rule has been pushed to all the gateway clusters and servers.

Our configuration changes do NOT require server reload, restart, or binary upgrade. So it’s very efficient and scalable.

Test the HTTP to HTTPS Redirect with curl

Let’s open a new browser tab to access the test-edge.com site via HTTP.

We can see it indeed becomes HTTPS. Note the small lock icon in the browser address bar.

On the terminal, we can also test it out using curl.

curl -Ss -I http://test-edge.com/

It is indeed a 301 redirect to use the HTTPS protocol.

Let’s try a more complex URI and query string.

curl -Ss -I 'http://test-edge.com/foo/bar?a=32&b=56'

We can see it is still a redirect to HTTPS.

And the URI and query string are also carried on.

FAQ

Should the HTTP to HTTPS redirect use 301 or 302?

OpenResty Edge’s Redirect action defaults to 302 (Moved Temporarily), and the Status Code dropdown also offers 301, 303, and 307. For enforcing HTTPS, switch it to 301 (Moved Permanently): moving a site from HTTP to HTTPS is a permanent change, not a temporary one, so the permanent status code is the one that describes it correctly.

Does the redirect keep the original URI and query string?

Yes. In the Redirect action, leave URI and URI arguments set to current, and only change Scheme to https. A request to http://test-edge.com/foo/bar?a=32&b=56 then redirects to the same path and query string over HTTPS — the curl -Ss -I test in this tutorial shows the Location header carrying both across unchanged.

Will this rule also redirect HTTPS requests?

No. The rule condition tests the Scheme variable for string equality with http, so it matches all HTTP requests and excludes any HTTPS ones. Requests that already arrive over HTTPS never match the condition and are passed through to your normal rules untouched.

Do I need to reload or restart the gateway to apply the redirect?

No. After you create the rule, make a new release and the rule is pushed to all gateway clusters and servers. Configuration changes in OpenResty Edge require no server reload, no restart, and no binary upgrade, which is what makes rolling a redirect out across a large fleet efficient.

Why should this redirect rule run before other page rules?

Place it ahead of your existing normal rules, and decide whether to skip any subsequent rules when it matches. For this particular rule that is not strictly necessary, but being explicit is always a good idea when you want request processing to stop immediately.

What is OpenResty Edge

OpenResty Edge is our all-in-one gateway software for microservices and distributed traffic architectures. It combines traffic management, private CDN construction, API gateway, security, and more to help you easily build, manage, and protect modern applications. OpenResty Edge delivers industry-leading performance and scalability to meet the demanding needs of high concurrency, high load scenarios. It supports scheduling containerized application traffic such as K8s and manages massive domains, making it easy to meet the needs of large websites and complex applications.

If you like this tutorial, please subscribe to this blog site and/or our YouTube channel. Thank you!

About The Author

Yichun Zhang (Github handle: agentzh), is the original creator of the OpenResty^® open-source project and the CEO of OpenResty Inc..

Yichun is one of the earliest advocates and leaders of “open-source technology”. He worked at many internationally renowned tech companies, such as Cloudflare, Yahoo!. He is a pioneer of “edge computing”, “dynamic tracing” and “machine coding”, with over 22 years of programming and 16 years of open source experience. Yichun is well-known in the open-source space as the project leader of OpenResty^®, adopted by more than 40 million global website domains.

OpenResty Inc., the enterprise software start-up founded by Yichun in 2017, has customers from some of the biggest companies in the world. Its flagship product, OpenResty XRay, is a non-invasive profiling and troubleshooting tool that significantly enhances and utilizes dynamic tracing technology. And its OpenResty Edge product is a powerful distributed traffic management and private CDN software product.

As an avid open-source contributor, Yichun has contributed more than a million lines of code to numerous open-source projects, including Linux kernel, Nginx, LuaJIT, GDB, SystemTap, LLVM, Perl, etc. He has also authored more than 60 open-source software libraries.