# Application Load Balancer (ALB) – Redirecting HTTP to HTTPS

Application Load Balancer (ALB) plays a critical role in **handling traffic securely** by enforcing **HTTPS redirection** and ensuring that all user requests follow secure communication protocols.

**🔹 Why It’s Important?** ✔ **Improves security** – Redirecting HTTP to HTTPS encrypts user data in transit.\
✔ **SEO benefits** – Google prioritizes HTTPS-secured websites.\
✔ **User trust & compliance** – Many security frameworks mandate HTTPS-only traffic.

***

### **🔹 How ALB Handles Traffic?**

ALB uses **Listeners, Rules, and Target Groups** to process incoming requests.

| **Component**    | **Function**                                                            |
| ---------------- | ----------------------------------------------------------------------- |
| **Listener**     | Monitors incoming traffic on a specific port (e.g., 80, 443).           |
| **Rules**        | Define how requests should be processed (e.g., redirect HTTP to HTTPS). |
| **Target Group** | Directs requests to EC2 instances, Lambda functions, or containers.     |

***

### **🔹 SecureCart Use Case: Enforcing HTTPS on ALB**

SecureCart, an **e-commerce platform**, must ensure that all traffic to `securecart.com` is encrypted.\
🔸 **Challenge:** Users might still visit the website using `http://securecart.com`.\
🔸 **Solution:** SecureCart configures an **ALB HTTP listener to redirect all HTTP traffic to HTTPS**.

#### **✅ SecureCart’s Implementation Steps**

1️⃣ **Ensure ACM SSL Certificate is attached** to the ALB for `securecart.com`.\
2️⃣ **Configure ALB Listeners:**

* HTTP (Port 80): **Redirect to HTTPS** (Port 443).
* HTTPS (Port 443): **Forward traffic** to target groups.\
  3️⃣ **Apply a Redirect Action Rule:**
* Redirect requests from `http://securecart.com` → `https://securecart.com`.
* Set the status code to `HTTP 301 (Moved Permanently)`.

***

### **🔹 Configuring ALB to Redirect HTTP to HTTPS**

To **redirect all HTTP traffic to HTTPS**:

✔ **Step 1:** Navigate to the **ALB Listener Configuration** in the AWS Console.\
✔ **Step 2:** Select the **HTTP (Port 80) Listener** and **add a rule**.\
✔ **Step 3:** **Set the action to "Redirect"** → Choose protocol `HTTPS` and port `443`.\
✔ **Step 4:** Save and deploy the rule.

✅ **Now, all requests to HTTP (`http://securecart.com`) will automatically redirect to HTTPS (`https://securecart.com`).**

***

### **✅ Best Practices for ALB HTTPS Redirection**

✔ **Use AWS Certificate Manager (ACM) to manage SSL/TLS certificates** for HTTPS.\
✔ **Always enforce HTTPS redirection at the ALB layer** instead of the application.\
✔ **Enable HTTP/2 support** on ALB for better performance.\
✔ **Monitor ALB logs** in S3 or AWS CloudWatch for security insights.

***

### **⚠️ Common Mistakes & How to Avoid Them**

| **Mistake**                                         | **Impact**                                     | **Solution**                                                        |
| --------------------------------------------------- | ---------------------------------------------- | ------------------------------------------------------------------- |
| **Not enabling HTTPS redirection**                  | Users may access insecure HTTP versions.       | **Set up ALB Redirect Actions** to force HTTPS.                     |
| **Forgetting to attach an SSL certificate**         | HTTPS traffic fails due to certificate errors. | Use **AWS Certificate Manager (ACM)** for automatic SSL management. |
| **Placing redirect logic in the application layer** | Adds unnecessary complexity & overhead.        | Always handle **redirection at the ALB listener level**.            |
| **Not updating DNS records**                        | Users may still access old HTTP URLs.          | **Update Route 53** records to point to the HTTPS-enabled ALB.      |

***

### **🔹 Summary**

✔ **ALB ensures secure traffic handling by enforcing HTTP to HTTPS redirection.**\
✔ **SecureCart uses ALB Listener Rules to enforce HTTPS and secure user connections.**\
✔ **Best practices include using ACM certificates, enforcing HTTPS at ALB, and monitoring logs.**\
✔ **Avoid common mistakes like forgetting SSL certificates or misconfiguring redirect rules.**