Possible to redirect from HTTPS to HTTP behind load-balancer?

Question

I have a basic ASP.NET application that sits behind an F5 load-balancer.

Incoming SSL requests (over HTTPS) terminate at the load-balancer and all internal communication between the load-balancer and my application servers is unsecure (over HTTP).

When a unsecure request comes in, my app is able to use Response.Redirect("https://...") to redirect a secure URL with no problems. However, the other direction appears to be impossible - I cannot redirect from HTTPS to HTTP using Response.Redirect() from my application. The URL remains HTTPS for the client and does not change. Could the F5 be preventing the redirect for ever reaching the client?

Is there any special configuration necessary to let this happen?

Solution

Yes, the F5 may be intercepting and rewriting the redirect to be HTTPS.

Find the HTTP Profile that is associated with your Virtual Server. What is "Rewrite Redirects" set to? Since you're the developer of the app, you probably want None. (Remember to make a new HTTP profile for your app rather than edit the default one.)

This option is designed to handle redirects from applications that aren't really SSL Offload aware.

There's a good article about this option on DevCentral.

On a related note, why are you redirecting back to HTTP? If your BIG-IP is hardware (not Virtual Edition) then it probably handles 500-2000 SSL TPS depending on licensed modules. What is your traffic load? I'm guessing you're unlikely to be establishing over 500 new SSL connections per second. It could be easier and more secure to keep everything on HTTPS.

Comments

[nothingisnecessary]

Also note that if asp.net web app is bound to http instead of https using stuff like Response.Redirect("~/folder/page.aspx") will cause IIS to send 302 redirect as http instead of https. For reason that you stated: IIS is not aware of SSL offloading; it thinks it is HTTP and so it acts like it is HTTP, like it should. This is issue to be fixed in F5 configuration.