not-kennethreitz / flask-sslify

Force SSL on your Flask app.
https://pypi.python.org/pypi/Flask-SSLify
BSD 2-Clause "Simplified" License
504 stars 85 forks source link

Bad HTTP/0.9 request type #54

Closed BenjaminPelletier closed 6 years ago

BenjaminPelletier commented 6 years ago

I have a minimal web app that works fine:

from flask import Flask

app = Flask(__name__)

@app.route('/')
def hello_world():
  return 'Hello, World!'

app.run(host='localhost', port='1234')

I can enable https successfully (page views fine this way):

from flask import Flask

app = Flask(__name__)

@app.route('/')
def hello_world():
  return 'Hello, World!'

app.run(host='localhost', port='1234', ssl_context='adhoc')

But, when I Flask-SSLify it:

from flask import Flask
from flask_sslify import SSLify

app = Flask(__name__)
sslify = SSLify(app)

@app.route('/')
def hello_world():
  return 'Hello, World!'

app.run(host='localhost', port='1234')

...visiting https://localhost:1234 yields ERR_SSL_PROTOCOL_ERROR in Chrome and the server prints out a bunch of code 400, message Bad HTTP/0.9 request type and code 400, message Bad request version. The redirect appears to work properly though; when I visit http://localhost:1234, I am redirected to the https page and I see a "GET / HTTP/1.1" 302 - on the server. What's going on here?

python --version yields Python 2.7.13 yolk -V Flask-SSLify yields Flask-SSLify 0.1.5

ShahNewazKhan commented 6 years ago

BUMP

BenjaminPelletier commented 6 years ago

I think the answer here is probably that Flask-SSLify merely replaces http endpoints with redirects to https endpoints; it does not implement those previously-http endpoints in https. The assumption is that the user will host a second, new set of endpoints implemented with https. So, for instance, all the end points at http://server/page would be hosted on port 80 and would redirect (via Flask-SSLify) to https://server/page which would be hosted on port 443. A key situation where this would not work is if you wanted your https pages to be served on the same port as your http pages. Redirecting http://server:8121/page to https://server:8121/page does not work because the Flask-SSLify handler does not serve https content.