Maintaining separate HTTP and HTTPS requests to origin servers

It is common to use the same origin web application to serve both HTTP and HTTPS requests and let the application determine which actions to take to secure communications depending on the incoming protocol. Fastly allows users to set this up to preserve this functionality within their servers. To set Fastly up to send HTTP requests to the non-secure service and HTTPS requests to the secure service, configure two origins, one each for the secure and non-secure ports, then set up the conditions under which requests will be sent there.

Create multiple origins

Begin by configuring the same origin address with a different port as a separate origin server. Follow the instructions for working with hosts. You'll add specific details about the non-secure server (port 80) when you fill out the Create a host fields:

1. In the Name field, enter a name for the non-secure server (for example, Server Name (plain)).
2. Click Add and configure.
3. In the Address field, enter the address of the non-secure server (for example, server.example.com).
4. In the Enable TLS? section, select No, do not enable TLS.

Follow the instructions for working with hosts to create another origin server, this time for your secure server. You'll add specific details about the secure server (port 443) when you fill out the Create a host fields:

1. In the Name field, enter a name for the non-secure server (for example, Server Name (secure)).
2. Click Add and configure.
3. In the Address field, enter the address of the non-secure server (for example, server.example.com).
4. In the Enable TLS? section, select Yes, enable TLS.

Conditionally send traffic to origins

To conditionally determine which server receives secure and non-secure requests, Fastly relies on the presence or absence of a specific header when the backend is selected. When an incoming connection is received over TLS, Fastly sets the req.http.fastly-ssl header to determine which server to use.

Set a condition for this header on each origin by following the steps below.

1. From the Home page, select the appropriate service. You can use the search box to search by ID, name, or domain.
2. Click Edit configuration and then select the option to clone the active version.
3. Click Origins.
4. Next to the name of the non-secure server, click Attach a condition.
5. Click Create a new request condition.
6. Fill out the Create a new request condition fields as follows:
   • In the Name field, enter the name of the condition specifying use of the non-secure server (e.g., Use non-secure).
   • In the Apply if field, enter !req.http.fastly-ssl.
   • Leave the priority set to its default value.
7. Create the new condition by clicking Attach.
8. From the Activate menu, select Activate on Production to deploy your configuration changes.