如何在Google Cloud AppEngine上强制执行https

Question

I am trying to force https for all traffic to an app hosted on Google Cloud AppEngine. https works, but despite following the instructions for rewriting http traffic to https, it's still possible to access the site with http, which causes problems.

I have added this to the app.yaml:

handlers:
  - url: /.*
    script: _go_app
    secure: always
    redirect_http_response_code: 301

but it doesn't seem to make any difference.

I am using the julienschmidt router and then this to handle all routes:

log.Fatal(fmt.Println(http.ListenAndServe(":8080", router)))

I have looked at using http.ListenAndServeTLS but this takes extra parameters and I can't work out what the values of those should be in the Google AppEngine context.

log.Fatal(fmt.Println(http.ListenAndServeTLS(":8443", "cert.pem", "key.pem", router)))

Where are "cert.pem" and "key.pem"?

I've read that I don't need to explicitly serve TLS in my app, because AppEngine will handle it for me, so even if I knew what the parameters were, I'm not sure it would help in forcing https.

http://sapling.appspot.com
https://sapling.appspot.com
http://sapling.money
https://sapling.money

All of the above work, but I don't seem able to force either of the http versions to https.

Answer 1

You are correct for including the secure: always element in your app.yaml as this will force HTTPS for your app's handlers.

However, I believe the following App Engine Documentation for "Securing Your App" found here may be of some use to you. As indicated in that link, you can convert HTTP URLs to HTTPS by simply replacing the periods between each resource with a -dot- instead. You may see the example provided below.

   http://[SERVICE_ID].[MY_PROJECT_ID].appspot.com
   https://[SERVICE_ID]-dot-[MY_PROJECT_ID].appspot.com 

For additional information about HTTPS URLs and resource targeting you may see how requests are routed here.

Hope this helps!