# Http to https redirection through middlewares does not work unless globally enforced **URL:** \ **Category:** Traefik v2\ **Tags:** kubernetes-ingress, middleware, docker\ **Created:** [July 3, 2020, 2:22pm UTC](https://community.traefik.io/t/http-to-https-redirection-through-middlewares-does-not-work-unless-globally-enforced/6755 "2020-07-03T14:22:56Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![steve-todorov](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/steve-todorov/32/3920_2.png) [@steve-todorov](https://community.traefik.io/u/steve-todorov)\ **Post date:** [July 3, 2020, 2:22pm UTC](https://community.traefik.io/t/http-to-https-redirection-through-middlewares-does-not-work-unless-globally-enforced/6755/1 "2020-07-03T14:22:56Z")
Hi, I've opened a very detailed issue on Github about this but it got automatically closed: [Http to https redirection through middlewares does not work unless globally enforced · Issue #6995 · traefik/traefik · GitHub](https://github.com/containous/traefik/issues/6995) In essence if you configure a router with `http` and `https` entry points and then add a `middleware` which redirects to https it won't work. To me this looks like a bug and not a misconfiguration, but I might be wrong. It seems like somebody else has had a similar issue as well: > **[Redirect Scheme middleware not redirecting page from http to https](https://community.traefik.io/t/redirect-scheme-middleware-not-redirecting-page-from-http-to-https/5704)** > > I configured my routers to have a chain middleware that consists of a redirectscheme middleware and a headers middleware (that contains a strict-transport-security header). Upon visiting an http page, I am not automatically redirected to the https... Does anybody know what I'm doing wrong? Is this actually a bug or not? ---
**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\ **Post date:** [July 3, 2020, 2:36pm UTC](https://community.traefik.io/t/http-to-https-redirection-through-middlewares-does-not-work-unless-globally-enforced/6755/2 "2020-07-03T14:36:59Z")
Your config directs the router to be TLS, bound to enttyPoints http(80),HTTPS(443) , is for Host [whoami.domain.com](http://whoami.domain.com) and uses middleware redirect-to-https. When you connect http to port 80 that configuration is not matched. No router on that service is http. (You can demonstrate this by doing a request on [https://whoami.domain.com:80](https://whoami.domain.com:80)) Based on the commented section in the static configuration Default http - \> https redirect is not what you want. You have to define another router on that service that is on entryPoint http and does not have tls enabled. Remove http from the existing routers entryPoints too, ---
**Author:** ![steve-todorov](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/steve-todorov/32/3920_2.png) [@steve-todorov](https://community.traefik.io/u/steve-todorov)\ **Post date:** [July 3, 2020, 3:23pm UTC](https://community.traefik.io/t/http-to-https-redirection-through-middlewares-does-not-work-unless-globally-enforced/6755/3 "2020-07-03T15:23:55Z")
Thanks for your reply! It looks like I have missed this part of the documentation: > If you need to define the same route for both HTTP and HTTPS requests, you will need to define TWO DIFFERENT routers: one with the tls section, one without. > [Routers | Traefik | v2.2](https://docs.traefik.io/v2.2/routing/routers/#tls) ---
**Author:** ![wellthatjustdumb](https://avatars.discourse-cdn.com/v4/letter/w/ce73a5/32.png) [@wellthatjustdumb](https://community.traefik.io/u/wellthatjustdumb)\ **Post date:** [July 1, 2023, 12:06pm UTC](https://community.traefik.io/t/http-to-https-redirection-through-middlewares-does-not-work-unless-globally-enforced/6755/4 "2023-07-01T12:06:32Z")
I had to create an account just to reply to this, because this is very unintuitive. Why would I need a "loose" router? Its unintuitive that a TLS router would only catch TLS traffic, especially when I put an HTTP -\> HTTPS middleware onto it as well. At least maybe show some logs, because the only kind of debugging that I have access to with Traefik is "404 page not found" and thats it. Nothing in the logs, just an access log with useless request information. NOWHERE does it mention that the route is not matched. And when I have HTTP -\> HTTPS redirecting middleware on top of my TLS enabled (or well, its just TLS or so it turns out, not "enabled", but "required and exclusively TLS"), there's no damn warning about the fact that this middleware is completely useless to use, because it will never be used. Just horribly unintuitive. /rant ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [July 1, 2023, 12:18pm UTC](https://community.traefik.io/t/http-to-https-redirection-through-middlewares-does-not-work-unless-globally-enforced/6755/5 "2023-07-01T12:18:30Z")
What is your problem? We usually try to be constructive here and help everyone out. By the way, you replied to a 3 year old post. ---
**Author:** ![wellthatjustdumb](https://avatars.discourse-cdn.com/v4/letter/w/ce73a5/32.png) [@wellthatjustdumb](https://community.traefik.io/u/wellthatjustdumb)\ **Post date:** [July 1, 2023, 1:04pm UTC](https://community.traefik.io/t/http-to-https-redirection-through-middlewares-does-not-work-unless-globally-enforced/6755/6 "2023-07-01T13:04:21Z")
So its still a valid problem, and has been, for the past 3 years. Sorry, I quit smoking 2 days ago and this was driving me crazy ---
**Author:** ![steve-todorov](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/steve-todorov/32/3920_2.png) [@steve-todorov](https://community.traefik.io/u/steve-todorov)\ **Post date:** [July 1, 2023, 1:18pm UTC](https://community.traefik.io/t/http-to-https-redirection-through-middlewares-does-not-work-unless-globally-enforced/6755/7 "2023-07-01T13:18:43Z")
It actually makes sense to have two distinctive routers - one for `TLS` an one for `HTTP` because of multiple reasons: 1. separation of concern 2. `letsencrypt` requires http for web verification 3. you could have multiple domains running on plain HTTP, but just X,Y,Z running on HTTPS (for whatever valid reason) The problem back then was that it wasn't very well documented and at the time v2 was very new (not sure of the current state of the docs) > there's no damn warning about the fact that this middleware is completely useless and stupid to use, because it will never be used. You just pointed out the obvious - `because it will never be used`. How could it print an error/notice, if the code is never executed? 😃 Anyway, just so it's more clear for anybody who might still bump into this issue and find this thread: 1. You need 2 routers: HTTP and HTTPS. This will then make traefik use ports `80` and `443` 2. You add the `redirect-to-https` middleware to the `HTTP` router. Whenever somebody visits `http://x.y.z`, the HTTP router will go through the `redirect-to-https` middleware and redirect the client to https. Hope this helps 🙂 p.s. Good job on quitting smoking! ---
**Author:** ![wellthatjustdumb](https://avatars.discourse-cdn.com/v4/letter/w/ce73a5/32.png) [@wellthatjustdumb](https://community.traefik.io/u/wellthatjustdumb)\ **Post date:** [July 1, 2023, 2:51pm UTC](https://community.traefik.io/t/http-to-https-redirection-through-middlewares-does-not-work-unless-globally-enforced/6755/8 "2023-07-01T14:51:39Z")
I'll probably be making a couple of pull requests, because it just doesn't make sense. When I open my router in the interface; - Entrypoints are :443 and :80 - Points to the HTTP router - Points to the HTTP middlewares (ipwhitelist + https scheme redirect) - Points to my service Router details: Shows web and websecure entrypoints, shows hostname, shows TLS is enabled with default options, shows Redirect to HTTPS. What this SHOULD say: - Entrypoint: :443 (HTTPS only) - HTTPS Router - HTTPS Middleware - Router details: Entrypoint websecure only - TLS: Exclusively enabled Middleware -\> Redirect to HTTPS: \< Warning, this route already is HTTPS only \> And then we have the fact that nothing is logged. When a route is not matched, I expect to at least see _something_ in the logs, preferably the accesslogs, and especially when I have debug logs enabled. EDIT: Yes, still probably a case of RTFM, but a descriptive UI and some logging would help. Also @bluepuma77 I'm sorry for my wording, I've changed it, I shouldn't be yelling to people like that ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [July 1, 2023, 6:27pm UTC](https://community.traefik.io/t/http-to-https-redirection-through-middlewares-does-not-work-unless-globally-enforced/6755/9 "2023-07-01T18:27:57Z")
In general you can have http and https entrypoints. For http you can place a redirect directly on the entrypoint. LetsEncrypt works fine with tlsChallenge on https alone. Traefik v3 let’s you set the default entrypoint for all routers globally, so http is only redirect. See [simple Traefik exampl](https://github.com/bluepuma77/traefik-best-practice/tree/main/docker-traefik-dashboard-letsencrypt)e. ---
**Author:** ![MNeverOff](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/mneveroff/32/7383_2.png) [@MNeverOff](https://community.traefik.io/u/MNeverOff)\ **Post date:** [July 24, 2023, 4:12am UTC](https://community.traefik.io/t/http-to-https-redirection-through-middlewares-does-not-work-unless-globally-enforced/6755/10 "2023-07-24T04:12:25Z")
I appreciate the conversation happened so far and would love to follow on and support @wellthatjustdumb I have been dumbfounded by this quirk of Traefik and posted a separate stackoverflow question as well ([docker - Traefik HTTP to HTTPS non-global redirect - is there a better way? - Stack Overflow](https://stackoverflow.com/questions/76751220/traefik-http-to-https-non-global-redirect-is-there-a-better-way)) The usecase, in my opinion, is quite simple. Whenever I configure a new router for a service, if I set https there is never any reason for http to really be exposed on that same router (host), unless I'm missing something? Most web clients when seeing an https available and tls enabled will _always_ default to https. Therefore, I'd love to be able to specify once that I want all http redirected to https instead of creating a whole new router just for the reditet. Something like this: ```auto # External .dev - traefik.http.routers.whoami.rule=Host(`whoami.example.com`) - traefik.http.routers.whoami.entrypoints=http, https - traefik.http.routers.whoami.tls.certresolver=lets-encrypt-tls - traefik.http.routers.whoami.middlewares=redirect-https@file ``` ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [July 24, 2023, 6:37am UTC](https://community.traefik.io/t/http-to-https-redirection-through-middlewares-does-not-work-unless-globally-enforced/6755/11 "2023-07-24T06:37:07Z")
You can specify a global redirect directly on entrypoint ([doc](https://doc.traefik.io/traefik/routing/entrypoints/#redirection)). And with Traefik v3 you can declare a default entrypoint, so all you routers can listen on websecure only by default ([doc](https://doc.traefik.io/traefik/master/routing/entrypoints/#asdefault)). ---
**Author:** ![steve-todorov](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/steve-todorov/32/3920_2.png) [@steve-todorov](https://community.traefik.io/u/steve-todorov)\ **Post date:** [July 24, 2023, 9:57am UTC](https://community.traefik.io/t/http-to-https-redirection-through-middlewares-does-not-work-unless-globally-enforced/6755/12 "2023-07-24T09:57:52Z")
> if I set https there is never any reason for http to really be exposed on that same router You need `http` in order to redirect clients arriving at the `http` entrypoint (meaning port 80) of your host to the `https` one. If there is nothing listening at port 80 (http) then the browser arriving at that entrypoint will return some form of 404 or `ERR_CONNECTION_REFUSED`. This can be hurtful to SEO and could mislead the person arriving at the http entrypoint that the site is offline. > Most web clients when seeing an https available and tls enabled will _always_ default to https **SOME** browsers **MAY** default to https when you enter `xyz.com` (without `http://` or `https://`). This does not mean **ALL** browsers **ALWAYS** redirect, which makes your assumption invalid. 🙂 ---
**Author:** ![MNeverOff](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/mneveroff/32/7383_2.png) [@MNeverOff](https://community.traefik.io/u/MNeverOff)\ **Post date:** [July 24, 2023, 3:23pm UTC](https://community.traefik.io/t/http-to-https-redirection-through-middlewares-does-not-work-unless-globally-enforced/6755/13 "2023-07-24T15:23:20Z")
Certainly, that's one option, but I also want to retain individual control over this as, for example, I don't want to bother and issue SSL certificates for my .local domains for internal IPs managed on the same Traefik container, which means that I need to configure it per-service, which means many and many extra unnecessary routers. ---
**Author:** ![MNeverOff](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/mneveroff/32/7383_2.png) [@MNeverOff](https://community.traefik.io/u/MNeverOff)\ **Post date:** [July 24, 2023, 3:24pm UTC](https://community.traefik.io/t/http-to-https-redirection-through-middlewares-does-not-work-unless-globally-enforced/6755/14 "2023-07-24T15:24:26Z")
Exactly right, that's why I feel like being able to redirect from one entrypoint to another (http -\> https) via one line instead of creating a whole other separate router would be wonderful, as not everyone is comfortable with defaulting their **entire** stack to be redirected from http to https.