5

I'm running the Content Management (CM) and Sitecore Identity Server (SIS) roles on a single AWS EC2 instance.

This is behind an AWS application load balancer, which accepts traffic on port 443 only and forwards it to these applications on port 80.

When the CM application redirects to the SIS application as part of the authentication flow, it's telling SIS its address is http://... as it only knows that it's running on port 80, and has no knowledge of the infrastructure in front of it. An example of the redirect URL is:

https://cm-91.sc/connect/authorize? ...&redirect_uri=http%3A%2F%2Fcm-91.sc%2Fidentity%2Fsignin...

This causes SIS to error because of an unauthorized client.

I can get around this, by adding both the HTTP and HTTPS addresses to the CORS allowed origins, which is not ideal, but is a workable solution.

However, after providing a valid username and password to SIS, the flow back to the CM application breaks because it's trying to redirect back to a HTTP address.

Is there a way to force the Sitecore CM application to generate self URLs with a HTTPS scheme?

1 Answer 1

2

You can solve the problem by simply forcing all requests on the CM to be on HTTPS by using the following IIS rewrite rule on your CM instance web.config

<rule name="HTTP/S to HTTPS Redirect" stopProcessing="true">
  <match url="(.*)" />
  <conditions logicalGrouping="MatchAny">
    <add input="{SERVER_PORT_SECURE}" pattern="^0$" />
  </conditions>
  <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" redirectType="Permanent" />
</rule>
2
  • I just tried this on my CM and now when I try to open up the CM in a browser I get an error saying "This page isn't working. Redirected you too many times. ERR_TOO_MANY_REDIRECTS". Am I doing something wrong? My rule looks exactly like this one. Aug 10, 2021 at 21:00
  • I'd say there is some other issue at play then. Aug 11, 2021 at 23:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.