Search code examples
google-cloud-platformgoogle-cloud-load-balancer

GCP load balancer does not redirect it's own ip to domain


I have setup a GCP load balancer following the steps as displayed on https://cloud.google.com/load-balancing/docs/https/ext-http-lb-tf-module-examples#with_a_backend . I have create an A record at my dns provider and I am succesfully able to reach my service through the domain name. I have also created a http to https redirecting load balancer, which only redirects when visiting the domain name.

However my problem is that I can also still directly access my load balancers ip adress over http, which in turn redirects to my backend service thus allowing insecure access to my service. I am not sure what steps there are to debug my configurations or if anyone has experienced something similar.


Solution

  • The simplest method is to redirect HTTP to HTTPS at your backend. That method provides you with more options and control.

    Tip: if the client arrives at an IP address, you most likely want to discard that traffic. That traffic is typically hackers, trolls, etc.

    You can also set up a redirect in the load balancer:

    Set up an HTTP-to-HTTPS redirect for global external HTTP(S) load balancer