CODEWITHSUNDEEP
securityhttpsdeploymentlets-encryptdokku
Amjed Omar
Amjed Omar

Reputation: 1014

How to make dokku deploy app to https connection only

I added domain to my dokku app

dokku domains:add myapp example.com

then I encrypted the app connection

dokku letsencrypt myapp

the problem is when I deployed my app it deployed to http and https connections

=====> Application deployed:
       http://example.com
       https://example.com

My question is how to make dokku deploy app to https connection only

The reason behind make dokku only deploy app to https connection

  1. Because if app deploy to http connection then the attacker can access my app via requested http connection http://example.com using postman (for example or other tool). An example of this case is heruko.com it is encrypted using Letsencrypt but if you try to make request using http connection http://heruko.com via postman then success response will returned.

  2. Another reason that if the https certificate expires then the attacker can access my app via http connection

Upvotes: 1

Views: 413

Answers (1)

Lukas_Skywalker
Lukas_Skywalker

Reputation: 2060

Dokku should redirect any requests to http-URLs to the respective https-URLs. So your visitors should be protected.

It is not a problem if an attacker accesses your app using http. The only difference is that anyone between your server and the hacker could intercept and modify the request data. But your server is not less secured when the http-URL is used.

Https is only used to protect the data between your visitors and your server. It does not protect your server in any way.

Upvotes: 1

Related Questions