HAProxy [WARNING] (4900) : parsing [/var/etc/haproxy/haproxy.cfg:...] : a 'http-request' rule placed after a 'redirect' rule will still be processed before.

[michaelschefczyk]

Dear All,

To redirect http to https, I am using a http frontend containing an advanced pass thru "redirect scheme https code 301 if !{ ssl_fc }". Since some time, I always get "[WARNING] (4900) : parsing [/var/etc/haproxy/haproxy.cfg:...] : a 'http-request' rule placed after a 'redirect' rule will still be processed before." when this is active.

I assume the reason is the fix against CVE-2021-40346 which added the following lines to http frontends:

http-request  deny if { req.hdr_cnt(content-length) gt 1 }
http-response deny if { res.hdr_cnt(content-length) gt 1 }

Is this correct and should I just ignore the warning? Is there better practice to redirect http to https? If not, can the warning be suppressed in a future version so that not everyone using this needs to think through this?

Thanks & regards

Michael Schefczyk