Entrypoints and Middleware placement?

[chupacabra]

Possibly a dumb question... if I am doing a redirect at the entrypoint and i also want middleware applied (for example IPAllowList and some security middlewares), do i have to add them to all the entrypoints or is it sufficient to just add it at the one that handles the redirects?

So, like this at a single entry point...

entryPoints:
# internal HTTPS handler - process all requests as HTTPS 
  websecure:
    address: ':443'
    asDefault: true
    forwardedHeaders:
      trustedIPs:
       - 10.10.10.5
    http:
      middlewares:
        - global-chain_geo-block-crowdsec
      tls:
        certResolver: cloudflare
        domains:
          - main: "my.tld"
            sans:
              - "*.my.tld"

# internal HTTP handler - forward everything to HTTPS
  web:
    address: ':80'
    forwardedHeaders:
      trustedIPs:
        - 0.0.0.0/0      # forward headers from anyone, had trouble forwarding just for proxy
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https

OR
Like this at all entrypoints?

entryPoints:
# internal HTTPS handler - process all requests as HTTPS 
  websecure:
    address: ':443'
    asDefault: true
    forwardedHeaders:
      trustedIPs:
       - 10.10.10.5
    http:
      middlewares:
        - global-chain_geo-block-crowdsec
      tls:
        certResolver: cloudflare
        domains:
          - main: "my.tld"
            sans:
              - "*.my.tld"

# internal HTTP handler - forward everything to HTTPS
  web:
    address: ':80'
    forwardedHeaders:
      trustedIPs:
        - 0.0.0.0/0      # forward headers from anyone, had trouble forwarding just for proxy
    http:
      middlewares:
        - global-chain_geo-block-crowdsec
      redirections:
        entryPoint:
          to: websecure
          scheme: https

[bluepuma77]

Good question, in general it shouldn’t matter. If the http entrypoint only redirects to https, there should be no real difference.

But there are potential threat scenarios where it might help to block a request on http, not redirect to https, because TLS is more CPU intensive.

On the other side, if someone really wants to bring down your service, they might always use https anyway.

We use security on https only, keep http lean, only redirect to https.