Naruzo's blog

SSL with Magento behind a load balancer

If there is a load balancer or other server handling SSL in front of your webserver, you need a way to tell Magento that it's receiving a secure connection, or else it will put you into a 302 redirect loop.

Put the following above the Mage::run... line at the bottom of your index.php to prevent this issue without overriding any Magento code:

This example is for Amazon EC2, but if your load balancer uses a different header, just change the `HTTP_X_FORWARDED_PROTO` portion.

/**
 * EC2's load balancer sets these for us so we know we're secure,
 *  preventing Magento from performing a redirect loop.
**/
if( isset($_SERVER['HTTP_X_FORWARDED_PROTO']) ) {
    $_SERVER['HTTPS'] = 'on';
    $_SERVER['SERVER_PORT'] = 443;
}

Amazon EC2 Elastic Load Balancing (ELB)

Random EC2 notes

• Comments welcome!! This is my first foray into EC2 land, so there may be better ways of doing these things.

Load Balancer

1. The health check interval is only valid to 1/10 of a minute
   • If you put "0.33" for example, saving the LB will fail with "Error: MalformedInput: undefined"
2. You need to open the port you're using for health checks in you Security Group or the check will fail
   • I don't yet know how to restrict access to -only- the internal LB addresses, so I used "10.0.0.0/8" to at least restrict to the internal network.
   • Combined with the User-Agent check below, it's OK security.

3. The HTTP health checker doesn't like anything except 200s.

   • If you have a password-protected site, allow the load balancer with something like this:

     # Let the health checker check our health
     SetEnvIf User-Agent ^ELB-HealthChecker IsHealthCheck=1
     ...
     <Location />
     ...
         AuthType Basic
         AuthName Restricted
         AuthUserFile /etc/apache2/htpasswd
         Require valid-user
         Order deny,allow
         Deny from all
         Allow from env=IsHealthCheck
     </Location>
     

4. If you setup your LB to handle SSL, and forward 80 and 443 to your webserver on port 80, you can use these headers to determine whether the original incoming connection was over SSL:

   X-Forwarded-Port: 443
   X-Forwarded-Proto: https
   

5. If you're performing IP-based authorization on your webservers, you'll need something like mod_extract_forwarded to process the X-Forwarded-For headers for you:
   • http://www.openinfo.co.uk/apache/