PHP/Apache call to "header: location" overriding scheme? - php

Question

This has been driving me mad for the last few hours. It seems like PHP/Apache/Pound/Haproxy (can't really tell) insists on redirecting a page to the same scheme/domain I was on before, even though I clearly state it should be a different one.
Background: we usually have an http:\\www.example.com domain coupled to an https:\\secure.example.com secure domain (note the different subdomains). This makes our development easy, since we don't have SSL certificates for all our developers/projects and we can just check if the URL starts with 'secure.'. For this project, the client wants https:\\www.example.com as a secure domain, so I thought: no problem, I'll just change the logic to detect that for production. That part is working fine.
However, in some cases the user needs to be redirected from secure to non-secure, e.g. when having logged in and being redirected to the homepage. I've narrowed it down to this simple test-case (note: secure and non-secure public directories are simply symlinks to one another):
<?php
// this is our server-specific way of detecting secure/non-secure in production
if (isset($_SERVER['HTTP_X_SSL_CIPHER'])) {
header("HTTP/1.1 Moved permanently", true, 301);
header("Location: http://www.example.com/test.php");
}
echo 'bubbles!';
You'd expect it to redirect once after calling https:\\www.example.com/test.php, and then echo "bubbles!". However, my browser insists on redirecting back to httpS:\\www.example.com/test.php, thus causing an endless loop.
If I replace the header call with an HTTP meta refresh and/or javascript redirect all works fine, but I really want it to work with the location header. Apache/PHP/Pound/Haproxy seem to be deciding for themselves that I should just stick to the secure domain, even though I'm explicitly telling them not to.
One other interesting thing to note is that the reverse (redirecting from non-secure to secure) seems to be working fine. Also, on other sites (on the same server) that use the https:\\secure.example.com scheme, everything is working fine too, presumably because the subdomain is different.
Does anyone have any idea why this could be happening, and what is causing it? Our server setup is: Pound to distribute https requests to hidden webservers on port 8080, then haproxy to do the same for non-secure on port 80 (and some other stuff like IMAP), and behind that just some plain vanilla Apache webservers.
The only thing I can think of is that somehow the load balancers are messing things up, but that doesn't make sense since the replies from the webservers are sent directly back to the client AFAICT... any ideas, anyone?
N.B. replaced the slashes in the examples with backslashes, or SO thought I would be posting "too many links". They're not links, they're example domains. If I wanted to post a link, I'd have added an anchor.

Answer 1

Found it; Pound defaults to rewriting any location header to "what was originally requested" if the domain names match (which they did in this case). See "RewriteLocation 0|1|2" in the ListenHTTPS section; should be set to 0 ("don't do this") in my case.