# Force Redirect HTTP to HTTPS
**URL:** https://meta.discourse.org/t/force-redirect-http-to-https/57393
**Category:** Support
**Created:** [February 14, 2017, 10:17pm UTC](https://meta.discourse.org/t/force-redirect-http-to-https/57393 "2017-02-14T22:17:44Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@arothberg](https://meta.discourse.org/u/arothberg)
#### Post date: [February 14, 2017, 10:17pm UTC](https://meta.discourse.org/t/force-redirect-http-to-https/57393/1 "2017-02-14T22:17:44Z")
I would to redirect users that access the discourse site on port http to port https. I have checked `force https` but that does not seem to be causing a redirect to happen. The SSL termination is being done external to discourse (discourse always listens on 80).
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [February 14, 2017, 10:18pm UTC](https://meta.discourse.org/t/force-redirect-http-to-https/57393/2 "2017-02-14T22:18:54Z")
> [@arothberg](#):
>
> The SSL termination is being done external to discourse (discourse always listens on 80)
So add a HSTS header there.
---
### Author:  [@arothberg](https://meta.discourse.org/u/arothberg)
#### Post date: [February 15, 2017, 12:40am UTC](https://meta.discourse.org/t/force-redirect-http-to-https/57393/3 "2017-02-15T00:40:28Z")
What does the `force https` setting do if it doesnt set HSTS and it doesnt do a 3xx redirect?
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [February 15, 2017, 12:45am UTC](https://meta.discourse.org/t/force-redirect-http-to-https/57393/4 "2017-02-15T00:45:54Z")
> [@arothberg](#):
>
> What does the `force https` setting do if it doesnt set HSTS and it doesnt do a 3xx redirect?
Add the SSL-only cookies among [other things](https://github.com/discourse/discourse/search?l=Ruby&q=force_https&utf8=%E2%9C%93).
In our recommended way to setting SSL, this is all handled automatically:
>
---
### Author:  [@arothberg](https://meta.discourse.org/u/arothberg)
#### Post date: [February 15, 2017, 12:52am UTC](https://meta.discourse.org/t/force-redirect-http-to-https/57393/5 "2017-02-15T00:52:35Z")
That template seeks to handle the SSL termination entirely. Would be nice to have a simpler template for cases where termination is handled by eg the load balancer. Also ,I think that even with that flag set, I a seeing cookies with out the secure flag set.
---
### Author:  [@michaeltcoelho](https://meta.discourse.org/u/michaeltcoelho)
#### Post date: [January 24, 2018, 3:24am UTC](https://meta.discourse.org/t/force-redirect-http-to-https/57393/6 "2018-01-24T03:24:30Z")
Hey @Falco, let me get into this conversation…
I’ve the same proble as @arothberg described. I am using a AWS Load Balancer with an Amazon Issued Certificate. When i was accessing my forum by [https://www.forum.com.br](https://www.forum.com.br) it worked fine, but when accessing by forum.com.br , as the default is http, not working.
I tried adding:
```plaintext
- replace:
filename: "/etc/nginx/conf.d/discourse.conf"
from: /server.+{/
to: |
server {
listen 80;
return 301 https://$$ENV_DISCOURSE_HOSTNAME$request_uri;
}
server {
```
But i received a Too Many Request error. I tried also:
```plaintext
- replace:
filename: "/etc/nginx/conf.d/discourse.conf"
from: /server.+{/
to: |
server {
listen 80;
server_name forum.com.br www.forum.com.br;
rewrite ^/(.*) https://$$ENV_DISCOURSE_HOSTNAME$request_uri permanent;
}
server {
```
But with no success…
Do you guys can help me? My forum is down..
Thanks in advance.
---
### Author:  [@michaeltcoelho](https://meta.discourse.org/u/michaeltcoelho)
#### Post date: [January 24, 2018, 10:33am UTC](https://meta.discourse.org/t/force-redirect-http-to-https/57393/7 "2018-01-24T10:33:25Z")
I’ve replace the entire `web.ssl.template.yml` with both snippets as i said above.
---
### Author:  [@savas](https://meta.discourse.org/u/savas)
#### Post date: [August 22, 2018, 10:26am UTC](https://meta.discourse.org/t/force-redirect-http-to-https/57393/8 "2018-08-22T10:26:54Z")
Did you solved that problem ? geting same bug …
---
### Author:  [@jose-zama](https://meta.discourse.org/u/jose-zama)
#### Post date: [January 4, 2019, 6:16pm UTC](https://meta.discourse.org/t/force-redirect-http-to-https/57393/9 "2019-01-04T18:16:22Z")
For people who use AWS Classic Load Balancer still trying to solve this.
You should read this page: [Use Elastic Load Balancing to redirect HTTP traffic to HTTPS | AWS re:Post](https://aws.amazon.com/premiumsupport/knowledge-center/redirect-http-https-elb/)
Basically, Ngnix should redirect to https if `X-Forwarded-Proto: http` . This header is set by the load balancer. Thus the communication between web server and load balancer is always http. That means that Ngnix serves only http and the load balancer through https.
So, what I did, was to add the following to my container configuration (web.yml):
```plaintext
run:
- replace:
filename: "/etc/nginx/conf.d/discourse.conf"
from: /server.+{/
to: |
server {
if ($http_x_forwarded_proto = 'http'){
return 301 https://$host$request_uri;
}
```
---
### Author:  [@MrBuBBLs](https://meta.discourse.org/u/MrBuBBLs)
#### Post date: [February 12, 2021, 1:26pm UTC](https://meta.discourse.org/t/force-redirect-http-to-https/57393/10 "2021-02-12T13:26:29Z")
Great hint indeed ! Thanks 🙏
I can confirm that using the `X-Forwarded-Proto` to redirect the requests also works like a charm with Google Cloud’s HTTPS Load Balancer, if anyone wonders 😉