HTTPS Redirection Check

Rule Details

Application Scenarios

HTTPS is an extension of HTTP. HTTPS encrypts data between a web server and a browser. You can use ELB to redirect HTTP requests to an HTTPS listener to improve your service security. If no redirection is configured, there might be the following risks:

• Privacy leakage: HTTP traffic is not encrypted. Attackers can easily steal sensitive data.
• Man-in-the-middle attack: Attackers can intercept or tamper with data during transmission, causing information leakage or malicious operations.
• Browser warning: Browsers mark HTTP websites as "insecure", causing users to distrust your websites.

Solution

Use ELB to redirect HTTP requests to an HTTPS listener for higher service security.

Rule Logic

• If an ELB listener protocol is not HTTP, this listener is compliant.
• If an ELB listener protocol is HTTP and the HTTP requests are redirected to an HTTPS listener, the ELB listener is compliant.
• If an ELB listener protocol is HTTP and the HTTP requests are not redirected to any HTTPS listener, the ELB listener is non-compliant.