# Haproxy http to https redirect host header

**URL:** <https://discourse.haproxy.org/t/haproxy-http-to-https-redirect-host-header/8638>\
**Category:** Help!\
**Created:** [April 24, 2023, 3:06pm UTC](https://discourse.haproxy.org/t/haproxy-http-to-https-redirect-host-header/8638 "2023-04-24T15:06:55Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![GuyIncognito](https://avatars.discourse-cdn.com/v4/letter/g/bb73d2/32.png) [@GuyIncognito](https://discourse.haproxy.org/u/GuyIncognito)\
**Post date:** [April 24, 2023, 3:06pm UTC](https://discourse.haproxy.org/t/haproxy-http-to-https-redirect-host-header/8638/1 "2023-04-24T15:06:55Z")

</div>

I’m doing the following to redirect non-https traffic to https:

```auto
redirect scheme https code 301 if !{ ssl_fc }

```

Which works great, however if a user injects a `Host` header they are redirected to that URI rather than the target.

**E.g.**

```auto
Request: http://example.com
Host Header: maliciousexample.com

```

**Expected:**

Redirect to [https://example.com](https://example.com/)

**Actual:**

Redirect to [https://maliciousexample.com](https://maliciousexample.com/)

Is it possible to replace the `Host` header with the target URI or failing that, check that the `Host` header is a domain I have configured?

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [April 24, 2023, 4:05pm UTC](https://discourse.haproxy.org/t/haproxy-http-to-https-redirect-host-header/8638/2 "2023-04-24T16:05:51Z")

</div>

Use redirect prefix:

```
redirect prefix https://example.com if !{ ssl_fc }

```

---

<div class="post-metadata">

**Author:** ![GuyIncognito](https://avatars.discourse-cdn.com/v4/letter/g/bb73d2/32.png) [@GuyIncognito](https://discourse.haproxy.org/u/GuyIncognito)\
**Post date:** [April 24, 2023, 4:11pm UTC](https://discourse.haproxy.org/t/haproxy-http-to-https-redirect-host-header/8638/3 "2023-04-24T16:11:11Z")

</div>

Thanks - is there a nice way to do this if I have many domains configured?

```auto
acl host_server_a hdr(host) -i example.com
acl host_server_a hdr(host) -i example1.com
acl host_server_b hdr(host) -i example2.com
acl host_server_c hdr(host) -i example3.com

```

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [April 24, 2023, 4:27pm UTC](https://discourse.haproxy.org/t/haproxy-http-to-https-redirect-host-header/8638/4 "2023-04-24T16:27:34Z")

</div>

I don’t know what the rest of your configuration looks like or what attack vectors you have in mind.

If you don’t want to respond to malicious host headers, actually deny them as opposed to restrict the http redirect:

```
http-request allow host_server_a or host_server_b or host_server_c
http-request deny

```

or

```
http-request allow host_server_a
http-request allow host_server_b
http-request allow host_server_c
http-request deny

```

You can also put the list of domains in a file. Read section 7 of the docs:

[http://docs.haproxy.org/2.6/configuration.html#7](http://docs.haproxy.org/2.6/configuration.html#7)

Then once you passed the host header check, redirect it all to https:

```
redirect scheme https code 301 if !{ ssl_fc }

```

---

<div class="post-metadata">

**Author:** ![GuyIncognito](https://avatars.discourse-cdn.com/v4/letter/g/bb73d2/32.png) [@GuyIncognito](https://discourse.haproxy.org/u/GuyIncognito)\
**Post date:** [April 25, 2023, 8:14am UTC](https://discourse.haproxy.org/t/haproxy-http-to-https-redirect-host-header/8638/5 "2023-04-25T08:14:47Z")

</div>

Thanks @lukastribus

Ended up doing a list of domains in a file:

```auto
http-request allow if { hdr_beg(host) -f /etc/haproxy/domains.cfg }
http-request deny

redirect scheme https code 301 if !{ ssl_fc }

```