0

I want to create a web server that does redirects HTTP to HTTPS. What is the simplest method to do this but also secure? Should the DNS handle this? (For example, Route53)

I used to do this with my app built from Node/Express but now that I am using a compiled language, I want to be able to do this by hand instead of relying on a framework.

If I configure DNS to redirect http to https, is that more secure than the server program? (My thinking here is that since the server never sent a response, the potential attacker's req never arrived and thus has no message to receive.)

Would it matter which DNS does this? (For example, if you purchased your domain from domain.com but your server is on AWS linked through Route53?)

2
  • 6
    DNS cannot do a redirect from HTTP to HTTPS. DNS just resolves the hostname to the IP address. Since the question is based on the assumption that DNS can do it, the whole question has no base anymore. – Steffen Ullrich Jan 17 at 9:36
  • 1
    You should redirect HTTP and set up HTTP Strict Transport Security (HSTS, RFC 6797); with HSTS preloading you can enable internal redirection in the browser even without the initial redirection from plain HTTP, but still you should have the redirection in place, too. – Esa Jokinen Jan 17 at 11:07
2

DNS cannot do this because DNS doesn't know anything about the protocol. It just turns a domain name into an IP address, so has no way to know whether the person making the request is using HTTP or HTTPS.

If you don't want to worry about handling this redirect in your application then you could handle it at the load balancer which (depending on the details) can be protocol-aware.

For AWS (which I bring up because it seems like you are using it) this means using an application load balancer (ALB) which can perform the redirect natively without additional infrastructure. It will also act as an SSL termination endpoint for your application.

From a security perspective there isn't much of a difference here - it is mainly about what is most convenient for you to maintain

Not the answer you're looking for? Browse other questions tagged or ask your own question.