CODEWITHSUNDEEP
google-app-enginegohttpstls1.2
Matt
Matt

Reputation: 45

How to force https on Google Cloud AppEngine

I am trying to force https for all traffic to an app hosted on Google Cloud AppEngine. https works, but despite following the instructions for rewriting http traffic to https, it's still possible to access the site with http, which causes problems.

I have added this to the app.yaml:

handlers:
  - url: /.*
    script: _go_app
    secure: always
    redirect_http_response_code: 301

but it doesn't seem to make any difference.

I am using the julienschmidt router and then this to handle all routes:

log.Fatal(fmt.Println(http.ListenAndServe(":8080", router)))

I have looked at using http.ListenAndServeTLS but this takes extra parameters and I can't work out what the values of those should be in the Google AppEngine context.

log.Fatal(fmt.Println(http.ListenAndServeTLS(":8443", "cert.pem", "key.pem", router)))

Where are "cert.pem" and "key.pem"?

I've read that I don't need to explicitly serve TLS in my app, because AppEngine will handle it for me, so even if I knew what the parameters were, I'm not sure it would help in forcing https.

http://sapling.appspot.com
https://sapling.appspot.com
http://sapling.money
https://sapling.money

All of the above work, but I don't seem able to force either of the http versions to https.

Upvotes: 1

Views: 750

Answers (3)

ZUKINI
ZUKINI

Reputation: 195

If you are using the secure:always handler and the requests are not being automatically redirected, then you are probably using App Engine Flex?

App Engine Flex does not support handlers, you can see this in the Flexible app.yaml documentation.

Instead, you can check in your code if a request was sent via HTTP or HTTPs and redirect. This is done with the App Engine specific header X-Forwarded-Proto.

The implementation is configured on your end and there is a brief paragraph on the subject.

You can also view similar Stack posts with the same answers 1

I hope this helps!

Upvotes: 3

Andres S
Andres S

Reputation: 1247

You can use the Strict-Transport-Security header to instruct the browser to prefer https over http for a given page or an entire domain as outlined in this document. In order to add HTTP Strict-Transport-Security headers (HSTS) to your app, you must implement the headers within your app's code, not within your app's config file (app.yaml or appengine-web.xml).

It is also a good idea to enable HSTS preloading if you register your application with Google's HSTS preload list. Firefox and Chrome will never load your site over a non-secure connection.

Upvotes: 0

Harmit Rishi
Harmit Rishi

Reputation: 130

You are correct for including the secure: always element in your app.yaml as this will force HTTPS for your app's handlers.

However, I believe the following App Engine Documentation for "Securing Your App" found here may be of some use to you. As indicated in that link, you can convert HTTP URLs to HTTPS by simply replacing the periods between each resource with a -dot- instead. You may see the example provided below. 

   http://[SERVICE_ID].[MY_PROJECT_ID].appspot.com
   https://[SERVICE_ID]-dot-[MY_PROJECT_ID].appspot.com

For additional information about HTTPS URLs and resource targeting you may see how requests are routed here.

Hope this helps!

Upvotes: 0

Related Questions