Setting to automatically redirect all http -> https

[naturalethic]

From what I can see, the only way to get a redirect to https is through WebDomainRedirects, which will not allow cyclic redirects. What I am looking for is a setting that assumes all http connections should be redirected to https.

[mjl-]

WebDomainRedirects is indeed more meant to redirect one domain to another, e.g. example.org to www.example.org.

If you have a WebHandler, and you don't set DontRedirectPlainHTTP (i.e. the default), all plain http requests will be forwarded to https for that handler. Or they should be. There is a caveat though: The domain and path in the webhandler have to match. Not a problem if you have a handler for /, but if you only have one for e.g. /app/, then a request to / on plain http will return a 404 without redirect. For now, you could add a fallback webhandler for / that serves an empty directory. It will match, redirect to https, then return a 404. Do you think this will work for you?

I was going to type that you could use a WebHandler with a WebRedirect with a BaseURL with https scheme. But I think it'll cause a redirect loop, because the request after the redirect will be for the same domain and path and match the redirect again. I think I should change WebRedirect to not match if the redirect destination URL has the same domain and path as the requested URL. No point in redirecting to the same URL. Will look into this.

[naturalethic]

Ok, I am seeing that the web server behaves as expected for forwarded handlers. My mistake was in trying to set up the user/admin services on the same interface. Those don't automatically forward, which spawned my original complaint.

I have switched them back to the localhost interface, and things seem ok now.

[mjl-]

Good point, I didn't think enough about that interaction. Perhaps you could disable the plain http account/admin in the listener, and add a webhandler with webdirect? Then for plain http requests, the builtin account/admin handler will not match, but the webredirect would. After the redirect, on https, the builtin account/admin handler will match.

[naturalethic]

Well gosh. I simply added a regular web forward to the admin listener and that works just like you'd think it would.

admin.mydomain.com -> http://127.0.0.1/admin/

Seems like should be the canonical way to expose admin to a public IP.

[mjl-]

Thanks. Indeed that forward works too, but it will always do an extra http transaction to handle admin requests and it could trigger the rate limiter (all requests coming from the same local ip).