Home / server / Questions / 915340
Accepted
Tom Brossman
Asked: 2018-06-06 13:03:34 +0800 CST

How to configure HSTS redirect prerequisites using CloudFront?

  • 772

The HSTS Preload List Submission website has very specific prerequisites which disallow combining protocol changes and redirects into one step (classic example - redirecting requests for http://example.com directly to https://www.example.com fails their test - a protocol upgrade to HTTPS must occur first, then the 'www' subdomain may be added in a discrete step). Is it possible to meet these rules for sites hosted on Amazon CloudFront?

A related question is here, about sending the necessary headers, but I already have that part tested and working. My issue is the redirect, for a site that uses a www subdomain.

I have CloudFront configured to 'Redirect HTTP to HTTPS' under the default behavior and that works perfectly for all HTTP requests, however requests to https://example.com first redirect to the downgraded protocol http://www.example.com before being upgraded to HTTPS, and this is where I am stuck. I need to handle HTTP and HTTPS requests for the second-level domain differently.

For clarity, here is the redirect pattern I want to achieve:

http://example.com > https://example.com > https://www.example.com
http://www.example.com > https://www.example.com
https://example.com > https://www.example.com
https://www.example.com

And here is what CloudFront is doing now, with the third line (protocol downgrade) resulting in HSTS Preload submission failure:

http://example.com > https://example.com > https://www.example.com
http://www.example.com > https://www.example.com
https://example.com > http://www.example.com > https://www.example.com
https://www.example.com
amazon-web-services

1 Answers

  1. Best Answer

    I suspect you may have overlooked the need to purge the CloudFront cache after changing the redirect target protocol to https, because the configuration described (in comments) should work as expected -- setting the "protocol" to "https" in the redirecting bucket's configuration should not do this:

    https://example.com > http://www.example.com > https://www.example.com

    Create a CloudFront invalidation request using the pattern /*. Once the invalidarion request is complete, as shown in the console, test again. If you still see unexpected behavior, please capture the response headers and edit them into the question.

    • 1