Redirect http:// requests to https:// on AWS API Gateway (using Custom Domains)

Question

I'm using AWS API Gateway with a custom domain. When I try to access https://www.mydomain.com it works perfectly, but when i try http://www.mydomain.com it can't connect.

Is there a way to redirect the http -> https with the custom domain in API Gateway? If not, is there a way to get the http:// links to work just like the https:// links?

Solution

API Gateway doesn't directly support http without TLS, presumably as a security feature, as well as for some practical considerations.

There is not a particularly good way to do this for APIs in general, because redirection of a POST request from HTTP to HTTPS is actually a little bit pointless -- the data is has already been sent insecurely by the time the redirect is generated, unless the client has asked the server to inspect the request headers before the body is sent, with Expect: 100-continue.

You can create a CloudFront distribution, and configure it to redirect GET and HEAD requests from HTTP to HTTPS... but if you send a POST request to such a distribution, CloudFront doesn't redirect -- it just throws an error, since (as noted) such a redirection would be more harmful than helpful.

However... if GET is your application, then it's pretty straightforward: first, deploy your API with a Regional (not Edge-Optimized) API endpoint with a system-assigned hostname, not a custom domain.

Then, create a CloudFront distribution that uses this regional API endpoint as its origin server, and configure the CloudFront distribution's behavior to redirect HTTP to HTTPS. Associate your custom domain name with the CloudFront distribution, rather than with API Gateway directly.

Comments

[Kyeotic]

Can you explain how to associate the custom domain with cloudfront?

[Michael - sqlbot]

@Tyrsius see docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/…

[Philipp Kyeck]

Hi @Michael-sqlbot, I know that this is a pretty old answer but maybe you can help me nonetheless. I set everything up as you explained. Had most of it but had to switch from pure API Gateway to CloudFront for the http->https redirects ... if I want to disable the default API endpoint and only serve through CloudFront's custom domain, can I do that? Just disabling it leads to 404s. What do I have to use as origin domain name if I disable it. Or can't this be done when using CloudFront?

[Finesse]

Thanks for the answer. AWS makes my life so much more complicated. What I want to do is just make my website run as a lambda function. I need all HTTP GET requests to be redirected to HTTPS (for users who type the website address manually) and to have access to the original request headers (accept-language, hostname, user-agent, etc). API Gateway doesn't even offer to redirect HTTP to HTTPS (why???) and CloudFront removes all the headers so that the website can't even get its hostname.

[Jamneck]

@Finesse I had the same issue. It appears that when using API Gateway with regional custom domains only HTTPS is supported and API Gateway does not redirect from HTTP to HTTPS. stackoverflow.com/a/58683733/3310669