Facing issue with SSL in GCP External loadbalancer

Question

I am trying to set the GCP external load balancer and route the traffic to the Laravel application in backend servers. I have imported my SSL and attached it to the load balancer. Also reserved static IP and attached to the loadbalancer. When I get the URL of my domain, main page is working without any issues, but when I provide username and login to login, its throwing below error.

steps:

I have created a stand-alone VM and attached it to an unmanaged instance group.

Backend configuration:

Healthcheck: ) Loadbalancer config:

The error message I am getting look like below.

Additional info: My backend server is using Apache webserver. I have disabled HTTP to https redirection in apache. When we directly map the domain to the server, the login URL working fine but when we map it to laodbalancer IP the login URL is going over http://exmaple.com/login.

It would be great if some one could help me here how to fix the error while login.

Answer 1

The information you’re about to submit is not secure because the site
is using a connection that’s not completely secure, your information
will be visible to others.

The above error you are getting due to applications frequently redirects to the destination page after a user logs in and they are frequently set up to run behind a Load balancer or Cloudflare. When all of these are present, your application may mistakenly believe that it is operating with HTTPS enabled and all URLs are safe. The error message may also arise from a form submission process that involves HTTP just once.

Forms that are submitted directly to http:// or that redirect to http:// while retaining form data are now subject to warnings in Chrome 88. For more details, see the Form is Not Secure bug in the most recent version of Chrome.

Make sure that each form submits to a secure HTTPS address. Make sure there aren't any HTTP follow-up redirects.

Refer to this medium blog for other workarounds and also this Knowledge base blog for more info.

Try accessing your application from a different browser or device and also clear your browser's cache and cookies. Try using HSTS which can prevent users from bypassing SSL browser warnings.