Skip to main content
ariefrse.my
HomeSkillsProjectsAI WorkWritingContact
Resume
All writing

Note · Infrastructure

How my website quietly lost its security padlock

Every trailing-slash redirect was downgrading visitors from HTTPS to plain HTTP. Browsers follow that without a word, so nothing ever looked broken.

July 6, 2026 · 4 min read

My portfolio runs as a static export in an nginx container, published through a Cloudflare Tunnel. Cloudflare terminates TLS, handling encryption with the visitor, then forwards to my server over plain HTTP.

nginx took that personally.

Symptom
A client-side POST to the contact form backend failed, but only on some routes. Pages loaded fine over HTTPS. Nothing in the console pointed at the server.
Cause
nginx built absolute Location: headers using its own scheme, which was HTTP, silently downgrading every trailing-slash redirect.
Fix
absolute_redirect off;

The chain

nginx's automatic directory redirects, /projects to /projects/, build an absolute Location: header using nginx's own scheme. Since the tunnel talks to nginx over HTTP, that scheme is HTTP, and so every trailing-slash redirect walked the visitor downhill:

  1. Visitor arrives on https://ariefrse.my/projects
  2. Page hits a trailing-slash redirect
  3. Visitor lands on http://ariefrse.my/projects/

The browser follows without complaint. The page still renders. Nothing looks broken, which is precisely why it survived.

One line fixes it:

# nginx.conf
absolute_redirect off;

Relative redirects, Location: /projects/, let the browser keep whatever scheme it arrived on.

The bug behind the bug

Here is the part I find harder to forgive than the nginx default.

The contact form had been "working" the entire time, because it faked success with a setTimeout and never sent anything anywhere. Wiring it up for real is what exposed the downgrade.

A fake implementation does not merely fail to deliver. It masks the infrastructure bugs that a real one would have surfaced months earlier. The placeholder was not neutral. It was actively holding the door shut on a finding.

What I learned

When TLS terminates upstream of your origin, audit every place the origin constructs absolute URLs: redirects, canonical links, sitemaps.

Run curl -sI against the origin and read the Location: headers yourself. The browser hides the downgrade from you, which is the whole problem.

nginxtlscloudflareredirects

Share

XLinkedInWhatsAppThreads

Related

  • Everything fails silentlyGreen is not evidence. It is the absence of evidence. A running gallery of production failures that passed every check that existed.
  • The settings that did nothing and the icons that didn't existConfiguration is a list of claims, and nothing checks claims by default. Two failures with the same shape: declared but never delivered.

© 2026 Muhammad Arief Roseli

GitHubLinkedInSnapInvois