I just finished setting up a load balancer with a few backend servers serving an API, I tried to hit it via https and discovered I need to set the CORS headers
but for the life of me no Googling has turned up anything. My setup roughly is a main service (actually hosted in aws for now) at https://www.example.com, then the api hosted at https://api.example.com on Google Cloud.
How can I set the load balancer COS such that I can hit api.example.com from the client side js on www.example.com
Is there even a way?
your backend server, at https://api.example.com should set the CORS headers. it's a browser security feature, the browser is at https://example.com but makes AJAX requests to a different domain.
set the headers from the backend application, it is not related to the load balancer (unless it re-writes headers).
read more about CORS - http://restlet.com/company/blog/2015/12/15/understanding-and-using-cors/
Related
I got the following setup: Cloudfront in account A and the ALB loadbalancer/webserver in Account B.
Cloudfront got a domain for the user, the loadbalancer a domain and certificate for the connection between cloudfront and loadbalancer / with security header and so on.
The initial website loads fine, but all links and scripts got the url of the loadbalancer. The webserver thinks that the client connects directly via the loadlanacer and adds the url of the loadlabancer to links and scripts etc. How can I tell the webserver that the origil url is the one from cloudfront? Is there a header I can set somewhere? The website is programmed in .net nuke, but Im not the developer of the website...
Thanks and best
I have deployed an Angular application on Firebase that uses Node.js APIs that is hosted on AWS Windows EC2 instance. When I try to run the Firebase app on the browser and try to log in, I get the following error:
The page at 'https://website.web.app/' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://IP-address/API'. This request has been blocked; the content must be served over HTTPS.
Is there a way I can load an SSL certificate onto the AWS EC2 instance to allow the APIs to be sent over an HTTPS url?
Is there a way I can load an SSL certificate onto the AWS EC2 instance to allow the APIs to be sent over an HTTPS url?
Yes, there are many ways of doing this. The easiest (don't confused with the cheapest) is to front your instance with an Application Load Balancer. Also you need your own domain. Once you have bought the domain, you can get free ssl from AWS ACM. After that you can easly add the ssl certificate to the ALB to have full support for HTTPS.
So I was able to get SSL certificate for my website and it is on AWS but for some reason when I input www.mydomain.com or mydomain.com it still shows unsecured on the browser but when I add https to mydomain.com it shows the secure icon. Please anyone with how to solve this?
The reason is the server has no redirection policy, you need to add redirection policy to redirect site from HTTP to HTTPs.
If you are using Application load balancer you can go through below article to set up HTTP to HTTPS redirection.
redirect-http-to-https-using-alb
If you are using Nginx, then you can look into redirect-http-to-https-in-nginx
https-everywhere
SSL in web applications is only carried out when your user loads the website using HTTPS. Generally in this situation you would want to perform a redirect (a 302 is more preferable initially than a 301 as it is not permanent in the event of a rollback).
There are a number of ways you can trigger a redirection without having to make any server changes, it all depends on your infrastructure setup.
If the first point of call is CloudFront you can update your viewer protocol policy to Redirect HTTP to HTTPS. CloudFront will redirect any HTTP request before they touch the origin.
If you're using an application load balancer then you can update your listener rule for HTTP to redirect HTTP to HTTPS. As with the above requests would not be forwarded to your host.
Otherwise if you're a Classic Load Balancer, Network Load Balancer or just plain EC2 then it falls to you modifying the configuration of your hosts to do the redirect (remembering to set to a 302).
Below are links for most common web servers:
Apache
Nginx
IIS
Tomcat
Once you're happy with the redirect, feel free to set as a 301.
The above answer work but in addition, if you are using a load balancer in your AWS EC2 instance you can follow this video link to the best explanation and practice.
How to redirect HTTP traffic to HTTPS in the EC2 Elastic Load Balancer
I have an EC2 instance which hosts a web site running in IIS. I have also set up a AWS Application Load Balancer with a HTTPS listener into which I have added my web site's SSL certificate (held in AWS Certificate Manager). The HTTPS listener redirects traffic to my target group which in turn points to my EC2 instance. The EC2 instance uses a security group to only allow traffic from the Load Balancer.
Firstly, am I correct in thinking that the Application Load Balancer decrypts the SSL traffic and as a result, this is forwarded to my target group using HTTP (in other words, my EC2 instance's security group only needs to accept HTTP traffic from the Load Balancer and I can remove my SSL certificate from IIS)?
Secondly, the main problem that I am experiencing at the moment is that the site has relative paths to some of the resources (CSS, JavaScript, etc). As a result I am getting mixed content errors in my FireFox console when I browse the site. I set up a HTTP listener in my Load Balancer to redirect traffic to HTTPS but this doesn't seem to be working for relative paths.
I don't particularly want to edit the site to change relative paths to fully qualified HTTPS URLs as it is a very complex content management system. Also, before using the Load Balancer the site was serving content perfectly (the DNS entry pointed to my EC2 instance's public IP address and there was a rewrite rule in IIS to handle non HTTPS traffic).
Any advice would be greatly appreciated.
For your first query, I think Yes. You can remove my SSL certificate from IIS and point EC2 instance's security group to accept HTTP traffic from the Load Balancer.
For your concern on relative path's problem, please go through this link: After introducing ALB, Mixed Content Error happened
I think it will be helpful.
Open your browser and click on the Network tab and check these call should be going somewhere else which is using HTTP, these are an outgoing call from your application and redirect will not fix these issue. see the screenshot
Seems like same error in your case, you serving images from some other side, not from the EC2, It's mean those request which EC2 server is supposed to answer will work fine, but those which your code try to pull JS file or other resources these are outgoing call and this is nothing to do with LB redirect rule.
Better to update your application and all the URLs to https.
When a user visits a page served over HTTPS, their connection with the
web server is encrypted with TLS and is therefore safeguarded from
most sniffers and man-in-the-middle attacks. An HTTPS page that
includes content fetched using cleartext HTTP is called a mixed
content page. Pages like this are only partially encrypted, leaving
the unencrypted content accessible to sniffers and man-in-the-middle
attackers. That leaves the pages unsafe.
Thanks for the replies. I managed to get to the bottom of the second issue. The site's web.config had a rewrite rule which was forcing URLs to lowercase (something to do with SEO). This was causing the problems when serving the CSS and JS files. I've made the necessary updates to this rule and it now appears to work (see IIS URL rewrite module url's to lowercase).
For the first issue, the SSL certificates do not need to be installed on the IIS web server - they are only required in AWS Certificate Manager and then to be assigned to the Load Balancer which in turn has 2 listeners - one to direct HTTPS traffic to my Target Group and one to redirect HTTP traffic to HTTPS.
My IIS site now only has HTTP bindings and only accepts HTTP traffic from the Load Balancer.
All seems to work!
I have a client application hosted on S3 with a custom domain on godaddy. Cloudfront is serving all of the http(s) requests - all of that is well and good. I have an SSL certificate through ACM. There is an input dialog on the UI that when submitted, makes a POST request to a flask application running on ELB, but this request is failing because ELB is not configured for HTTPS (i.e. chrome is blocking an HTTP request because of mixed-content). Requests to the HTTP version of the endpoint work fine, but HTTPS requests time out. How do I configure the ELB load balancer to accept HTTPS requests? I've modified the configuration of the load balancer like so: https://imgur.com/3zWpS7f but requests are still failing. Any tips? Much appreciated!!
EDIT: I've configured the load balancer with a security group that allows ingress on 443 with HTTPS but now i'm getting a "Not secure" message with Chrome. is this because the certificate is registered with a domain associated with the site and not this api? do i need a separate certificate? The error code from chrome is: err_cert_common_name_invalid