# How we split Plug.SSL to control SSL redirection

**URL:** <https://forum.devtalk.com/t/how-we-split-plug-ssl-to-control-ssl-redirection/2988>\
**Category:** Blogs/Articles/Talks/Podcasts\
**Tags:** elixir, elixir-plug, ssl, https\
**Created:** [9 October 2020 09:22 UTC](https://forum.devtalk.com/t/how-we-split-plug-ssl-to-control-ssl-redirection/2988 "2020-10-09T09:22:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![wolf4earth](https://forum.devtalk.com/user_avatar/forum.devtalk.com/wolf4earth/32/8094_2.png) [@wolf4earth](https://forum.devtalk.com/u/wolf4earth)\
**Post date:** [9 October 2020 09:22 UTC](https://forum.devtalk.com/t/how-we-split-plug-ssl-to-control-ssl-redirection/2988/1 "2020-10-09T09:22:48Z")

</div>

> **[How we split Plug.SSL to control SSL redirection](https://dev.betterdoc.org/elixir/phoenix/plug/ssl/2020/09/25/how-we-split-plug-ssl-to-control-ssl-redirection.html)**
>
> Photo by Shane Aldendorff on Unsplash Recently I set out to configure a service of ours to run behind a reverse proxy with TLS termination. With Phoenix being the great framework it is, I assumed this would be a breeze. But it turned out that reality...

---

<div class="post-metadata">

**Author:** ![AstonJ](https://forum.devtalk.com/user_avatar/forum.devtalk.com/astonj/32/7_2.png) [@AstonJ](https://forum.devtalk.com/u/AstonJ)\
**Post date:** [9 October 2020 15:52 UTC](https://forum.devtalk.com/t/how-we-split-plug-ssl-to-control-ssl-redirection/2988/3 "2020-10-09T15:52:19Z")

</div>

Great post Sascha, I am sure it will help a lot of people!

I don’t have a Phoenix app in production yet but for anyone using HAProxy, these lines on the frontend may also be of help:

```auto
reqadd X-Forwarded-Proto:\ https if { ssl_fc }
redirect scheme https if ssl_redirect_hosts !{ ssl_fc }
redirect scheme https code 301 if !{ ssl_fc }

```

In conjunction with configuring plug to handle `X-Forwarded-*` headers as per Sascha’s post.

---

<div class="post-metadata">

**Author:** ![Exadra37](https://forum.devtalk.com/user_avatar/forum.devtalk.com/exadra37/32/683_2.png) [@Exadra37](https://forum.devtalk.com/u/Exadra37)\
**Post date:** [9 October 2020 23:01 UTC](https://forum.devtalk.com/t/how-we-split-plug-ssl-to-control-ssl-redirection/2988/4 "2020-10-09T23:01:44Z")

</div>

> exclude some requests from the redirect (and as such the HSTS header)

From the moment you set the HSTS header the browser will honor it for any endpoint not just for the one from where you sent it in a response.

> **[Strict-Transport-Security - HTTP | MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security)**
>
> The HTTP Strict-Transport-Security response header (often abbreviated as HSTS) informs browsers that the site should only be accessed using HTTPS, and that any future attempts to access it using HTTP should automatically be converted to HTTPS.

> The HTTP Strict Transport Security header informs the browser that it should never load a site using HTTP and should automatically convert all attempts to access the site using HTTP to HTTPS requests instead.

Or am I misunderstanding your proposal?