Ingress-nginx: Permanent redirect 308 not supported in IE11

[tlbdk]

IE 11 does not support permanent redirect 308 with default headers, so it might not be the best default.

It was introduced in this pull request:
https://github.com/kubernetes/ingress-nginx/pull/1776

You could also support a fall back mode based on user agent:
https://stackoverflow.com/questions/37701100/redirecting-ie-7-and-ie-11-by-useragent-nginx-config

It might be possible to get IE 11 to support permanent redirect 308 if the redirect page presented does not trigger compatibility mode, but older versions of IE still won't support 308.

[aledbf]

@tlbdk it's hard to define defaults. We could "complain" about the TLS ciphers too because they not work with java 6 so you need to adjust the configuration using the configmap.

You could also support a fall back mode based on user agent:

We are not going to start doing this. The template is already too complex and adding if sections is not a solution.

It might be possible to get IE 11 to support permanent redirect 308 if the redirect page presented does not trigger compatibility mode, but older versions of IE still won't support 308.

Can you be more specific or show an example? http://test.greenbytes.de/tech/tc/httpredirects/

[tlbdk]

@aledbf older and unsupported versions of IE and Java should die as quickly as possible. But IE 11 i guess we have to live with a bit longer as we still have quite a few users on it and it's still supported.

Might have been nice to have kept 301 as default and 308 as the option, but hey other people will find this issue and apply the same fix as us.

We did not notice the issue because of HSTS, so if we ever visited the site before with the old 301 default the browser would remember to do the automatic redirect to https and skip the new 308 page.

Only new customers would get this lovely page:

I did not have time to debug this, but from past experience, IE has some funny ways to find out if it should render a page in comparability mode and this might also affect if it supports 308. This could mean that one fix could be to set the special IE meta tags/headers that tells it not to run in comparability mode or make the redirect page's HTML look more modern so comparability mode won't kick in.

[aledbf]

Might have been nice to have kept 301 as default and 308 as the option, but hey other people will find this issue and apply the same fix as us.

It's hard to define default that will work for all the users.

[aledbf]

Closing. Please adjust the redirect code to 301. Keep in mind doing this you cannot do redirects with post request.

[thomaspeitz]

Ingress Controller 0.10.2
Kubernetes 1.8.x

What happened:
This morning some of our customers told us they can not reach our website. We realized that only customers with windows systems contacted us. After some research we found out that annotation nginx.ingress.kubernetes.io/force-ssl-redirect: "true" uses a 308 rewrite. Which is the best way to rewrite but sadly it does not support all clients. Old Internet Explorer versions have problems with it (for example win 7). We could fix it ourselves quickly through:
Configmap:
http-redirect-code: "301"

What you expected to happen:
I would expect to use 301 as default after this incidence. I bet there are more companies out there which will fall into this trap. 308 is more complex and fits the POST request but it is saver to use 301.

How to reproduce it
Create a ingress rule with nginx.ingress.kubernetes.io/force-ssl-redirect: "true" annotation and visit the website via http on an internet explorer.
https://www.browserling.com/browse/win/vista/ie/9/$YOURDOMAIN

So basically i would suggest that i change documentations that people should use 301 because of internet explorer.

Greetings, Thomas

[dewnull]

can Annotation nginx.ingress.kubernetes.io/permanent-redirect-code be used to control http-redirect-code for specific Ingress objects?

[Roderick-Jonsson]

I tried the redirect fix from @thomaspeitz but this time I get a "This page can’t be displayed" error. I summarised the question in this stackoverflow question.

Any help or pointing in the right direction would be much appreciated as I am stuck with how to debug this further.
https://stackoverflow.com/questions/63776021/nginx-ingress-https-redirect-for-ie11-win8-1-not-working