> ## Documentation Index
> Fetch the complete documentation index at: https://datum.net/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# HTTP to HTTPS Redirect with HTTPProxy

> Force HTTPS by redirecting all plain HTTP requests using a RequestRedirect filter on a Datum HTTPProxy.

> [!NOTE]
>
> A load balancer created with `datumctl alb create` forces HTTPS by default, because the command adds a redirect rule like the one on this page. An `HTTPProxy` that you write yourself doesn't redirect unless you add the rule. This guide applies when you manage the `HTTPProxy` directly, or when you need a custom redirect — for example, from a specific path or with a different status code.
>
> The rule matches only requests whose `x-forwarded-proto` header is `http`. The load balancer listens on both HTTP and HTTPS, so a rule that matched every request would also redirect HTTPS requests to themselves.

***

## Overview

A `RequestRedirect` filter responds to the client with a redirect response directly — no backend is reached. The [Application Load Balancer](https://datum.net/docs/alb/overview.md) handles the redirect at the proxy layer.

At a high level, this setup:

1. Matches all incoming requests on a hostname
2. Returns a `301 Moved Permanently` redirect to the same URL using `https`

***

## Prerequisites

* `datumctl` installed and authenticated
* A valid **Project**
* An existing `HTTPProxy` hostname, or create a new one with this guide

***

## Configuration Steps

### Step 1: Set Variables

**macOS / Linux**

```bash theme={null}
PROJECT="your-project-id"
NAMESPACE="default"
PROXY_NAME="https-redirect-demo"
HOSTNAME="your-app.example.com"
```

**Windows (PowerShell)**

```powershell theme={null}
$PROJECT    = "your-project-id"
$NAMESPACE  = "default"
$PROXY_NAME = "https-redirect-demo"
$HOSTNAME   = "your-app.example.com"
```

***

### Step 2: Apply the Redirect Configuration

The `RequestRedirect` filter requires `type: RequestRedirect`. No backend is needed — the redirect is returned immediately by the proxy.

**macOS / Linux**

```bash theme={null}
cat <<EOF | datumctl apply --project $PROJECT --namespace $NAMESPACE -f -
apiVersion: networking.datumapis.com/v1alpha
kind: HTTPProxy
metadata:
  name: $PROXY_NAME
spec:
  hostnames:
  - $HOSTNAME
  rules:
  - name: https-redirect
    matches:
    - path:
        type: PathPrefix
        value: /
      headers:
      - name: x-forwarded-proto
        type: Exact
        value: http
    filters:
    - type: RequestRedirect
      requestRedirect:
        scheme: https
        statusCode: 301
EOF
```

**Windows (PowerShell)**

```powershell theme={null}
@"
apiVersion: networking.datumapis.com/v1alpha
kind: HTTPProxy
metadata:
  name: $PROXY_NAME
spec:
  hostnames:
  - $HOSTNAME
  rules:
  - name: https-redirect
    matches:
    - path:
        type: PathPrefix
        value: /
      headers:
      - name: x-forwarded-proto
        type: Exact
        value: http
    filters:
    - type: RequestRedirect
      requestRedirect:
        scheme: https
        statusCode: 301
"@ | datumctl apply --project $PROJECT --namespace $NAMESPACE -f -
```

***

## Verification

Test that a plain HTTP request receives a redirect:

```bash theme={null}
curl -I http://$HOSTNAME/
```

Expected response:

```
HTTP/1.1 301 Moved Permanently
Location: https://your-app.example.com/
```

Confirm that the `Location` header uses `https` and preserves the path.

***

## Cleanup

**macOS / Linux**

```bash theme={null}
datumctl delete httpproxy $PROXY_NAME \
  --project $PROJECT --namespace $NAMESPACE --ignore-not-found
```

**Windows (PowerShell)**

```powershell theme={null}
datumctl delete httpproxy $PROXY_NAME `
  --project $PROJECT --namespace $NAMESPACE --ignore-not-found
```

***

## Troubleshooting

| Symptom | Root Cause | Resolution |
| - | - | - |
| API rejects the resource | `type` field missing from filter | Add `type: RequestRedirect` to the filter |
| Redirect loop | Both HTTP and HTTPS rules redirect | Ensure the redirect rule only targets HTTP traffic |
| `Location` header has wrong hostname | Hostname not set | Add `hostname` to `requestRedirect` to override |
| Client receives `302` instead of `301` | `statusCode` is unset (the default is `302`) or set to `302` | Set `statusCode: 301` for a permanent redirect |

***

## Best Practices

* Use `statusCode: 301` for permanent redirects — browsers and crawlers cache these
* Use `statusCode: 302` only when the redirect is temporary (e.g., maintenance)
* If redirecting to a different hostname, set `requestRedirect.hostname` explicitly rather than relying on the `Host` header

***

## Summary

* HTTP to HTTPS redirects use `type: RequestRedirect` with `scheme: https`
* The `type` field is required on all filters
* No backend is needed — `RequestRedirect` is a terminal filter that responds to the client directly
* `statusCode` accepts `301`, `302`, `303`, `307`, or `308`, and defaults to `302`


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.