RedirectSSL Concept #348

New Issue

2026-10-05T04:14:33+02:00

adam commented

2026-10-05 04:14:33 +02:00

I think that ZNC should have the ability to do what apache can do in terms of changing an HTTP request to HTTPS automatically. This would be awesome because then you wouldn't have to worry about adding HTTPS every time.

https://wiki.apache.org/httpd/RedirectSSL

I think that ZNC should have the ability to do what apache can do in terms of changing an HTTP request to HTTPS automatically. This would be awesome because then you wouldn't have to worry about adding HTTPS every time. https://wiki.apache.org/httpd/RedirectSSL

adam closed this issue

2026-10-05 04:14:33 +02:00

adam commented

2026-10-05 04:14:35 +02:00

I currently run ZNC's webadmin behind nginx to get this (among other things). +1

I currently run ZNC's webadmin behind nginx to get this (among other things). +1

adam commented

2026-10-05 04:14:35 +02:00

How do I run it under a different web server?

How do I run it under a different web server?

adam commented

2026-10-05 04:14:36 +02:00

@dylanhansch Look around for guides to setting up your preferred HTTP server (Apache, nginx, lighttpd, etc.) as a "reverse proxy". Note that ZNC really needs to be a nightly version at the moment, if you want webadmin to work behind a reverse proxy without random logouts. (It needs the X-Forwarded-For header support that was added since the last stable release.)

@dylanhansch Look around for guides to setting up your preferred HTTP server (Apache, nginx, lighttpd, etc.) as a "reverse proxy". Note that ZNC really needs to be a nightly version at the moment, if you want webadmin to work behind a reverse proxy without random logouts. (It needs the X-Forwarded-For header support that was added since the last stable release.)

adam commented

2026-10-05 04:14:37 +02:00

But... this breaks concept of SSL?
As initial connect it not SSL, mitm can simply make it not redirect.
So users, instead of relying that mitm isn't presented, learn to use SSL from the start.

But... this breaks concept of SSL? As initial connect it not SSL, mitm can simply make it not redirect. So users, instead of relying that mitm isn't presented, learn to use SSL from the start.

adam commented

2026-10-05 04:14:37 +02:00

A Strict-Transport-Security header could force the browser to replace the users 'http' with 'https'. I think this would produce results similar as wanted.

A Strict-Transport-Security header could force the browser to replace the users 'http' with 'https'. I think this would produce results similar as wanted.

adam commented

2026-10-05 04:14:38 +02:00

Uhm. If I understand this correctly, RedirectSSL just means to redirect requests that go to http port 80 to https port 443. However, ZNC doesn't use the standard ports and there is no usable connection between any ssl and non-ssl port.

So if you want to force everything to be SSL, just don't enable a non-SSL port? You have to explicitely state the port number anyway since your ZNC likely doesn't listen on port 443. If it does, just use a tiny HTTP server that listens on port 80 and redirects requests to https and port 443...?

Do I misunderstand something or what is the actual issue here?

Uhm. If I understand this correctly, RedirectSSL just means to redirect requests that go to http port 80 to https port 443. However, ZNC doesn't use the standard ports and there is no usable connection between any ssl and non-ssl port. So if you want to force everything to be SSL, just don't enable a non-SSL port? You have to explicitely state the port number anyway since your ZNC likely doesn't listen on port 443. If it does, just use a tiny HTTP server that listens on port 80 and redirects requests to https and port 443...? Do I misunderstand something or what is the actual issue here?

adam commented

2026-10-05 04:14:39 +02:00

In case he wants a redirect http://znc.in:1337 -> https://znc.in:1337
Port 80/443 is not needed here. HSTS and an HTTP reply if the browser erroneously talk to an HTTPS port with HTTP would do that

In case he wants a redirect http://znc.in -> https://znc.in:1337, this should be done with an external program, because http with omitted port defaults to port 80, and to get this behavior znc needs to bind to port 80 by some kind of default. And i dont think thats acceptable.

I suspect you are thinking of some kind like http://znc.in -> https://znc.in, which is a special case of the second one where znc is bound to 443 and therefore the port doesnt need to be specified.

In case he wants a redirect http://znc.in:1337 -> https://znc.in:1337 Port 80/443 is not needed here. HSTS and an HTTP reply if the browser erroneously talk to an HTTPS port with HTTP would do that In case he wants a redirect http://znc.in -> https://znc.in:1337, this should be done with an external program, because http with omitted port defaults to port 80, and to get this behavior znc needs to bind to port 80 by some kind of default. And i dont think thats acceptable. I suspect you are thinking of some kind like http://znc.in -> https://znc.in, which is a special case of the second one where znc is bound to 443 and therefore the port doesnt need to be specified.

adam commented

2026-10-05 04:14:39 +02:00

In case he wants a redirect http://znc.in:1337 -> https://znc.in:1337
Port 80/443 is not needed here. HSTS and an HTTP reply if the browser erroneously talk to an HTTPS port with HTTP would do that

That's not what the RedirectSSL wiki page that was linked to explains/does.

> In case he wants a redirect http://znc.in:1337 -> https://znc.in:1337 > Port 80/443 is not needed here. HSTS and an HTTP reply if the browser erroneously talk to an HTTPS port with HTTP would do that That's not what the RedirectSSL wiki page that was linked to explains/does.

adam commented

2026-10-05 04:14:40 +02:00

Is reimplementing RedirectSSL for ZNC the only solution to achive the wanted behavior?

Is reimplementing RedirectSSL for ZNC the only solution to achive the wanted behavior?

adam commented

2026-10-05 04:14:41 +02:00

I was talking about having http://znc.in:1337 -> https://znc.in:1337. (I use port 7778, and that is SSL. I want to keep SSL. But it's annoying to have to manually type in https every time)

I was talking about having http://znc.in:1337 -> https://znc.in:1337. (I use port 7778, and that is SSL. I want to keep SSL. But it's annoying to have to manually type in https every time)

adam commented

2026-10-05 04:14:41 +02:00

Duplicate of #320

Duplicate of #320

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#348