Re: HTTP header to insert for SSL offload

Hey Tony, that's kind of weird, b/c in my experience (working with NetScalers for the last 9 years or so) there's a front-end server and a back-end server for OWA, and if an SSL offload device terminates the SSL then all we have to do is insert a standard header (which OWA knows) which gets sent back in every request to the back-end server so it knows it came in on SSL and to generate the URLs with https://.

Here's our article on it: http://support.citrix.com/article/CTX109881

Ahh, ok, we use underscores for our header; MS uses dashes, so it was hard to google at first.  Here we go: http://technet.microsoft.com/en-us/library/aa997519(EXCHG.65).aspx

So that article says if you can't do the custom header insertion, then use the ISAPI filter you linked to.  But it also links to this article: http://support.microsoft.com/?kbID=307347

Which talks about inserting the custom header when using ISA and I assume that's where we got the idea to do that...HTH!

                                                                                                                BINO

--
Bino Gopal
Sr Systems Engineer, Western US
NetScaler Product Group
Citrix Systems, Inc.
[email protected] <mailto:[email protected]>



From: [email protected] [mailto:[email protected]] On Behalf Of Tony Bourke
Sent: Monday, April 27, 2009 5:20 PM
To: Load Balancing Mailing List
Subject: Re: [load balancing] HTTP header to insert for SSL offload

Hi Eric,

Great to see a fellow Portlander on the list.

I'm not aware if there's a standard header, but SSL_OFFLOAD seems reasonable.  The real trick is if the application knows to look for that, or any other header, in order to trigger link creation with https://.  Some web apps, like Microsoft OWA, don't, and instead use a registry setting: http://support.microsoft.com/kb/327800

What load balancer are you using?  Some will intercept the HTTP content going back to the client and re-write URLs with HTTPS.

Tony


On Apr 27, 2009, at 4:22 PM, Rosenberry, Eric wrote:


We are having a problem with a new application being written in house whereby the application generates all redirects with http:// links instead of https:// links.  The application has no idea that it is being front-ended by a SSL offloading load balancer.

The solution I find out on the Internet is to have the load balancer insert some kind of header into each request to tell the application to generate all redirects with https:// instead of http.

My question to the list:  Is there a standard header recommended for this purpose, or does everyone make up their own?  I see several references to this online.  I believe Citrix recommends "SSL_OFFLOAD".

Any suggestions?

Thanks!

-Eric
_______________________________________________________________
Eric Rosenberry
Sr. Network Engineer | Chief Bit Plumber
Direct +1. 503.943.6763 | Mobile: +1.503.348.3625 | Fax: +1.503.224.1581


iovation
111 SW Fifth Avenue
Suite 3200
Portland, OR 97204
www.iovation.com<http://www.iovation.com/>

The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any dissemination, distribution or copying is strictly prohibited. If you think that you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
_______________________________________________
lb-l mailing list
[email protected]<mailto:[email protected]>
http://vegan.net/mailman/listinfo/lb-l
Searchable Archive: http://vegan.net/lb/archive
http://lbdigest.com Load Balancing Digest
http://lbwiki.com Load Balancing Wiki

_______________________________________________
lb-l mailing list
[email protected]
http://vegan.net/mailman/listinfo/lb-l
Searchable Archive: http://vegan.net/lb/archive
http://lbdigest.com Load Balancing Digest
http://lbwiki.com Load Balancing Wiki