Permanently Redirect Http To Https On Google App Engine Flexible With Django

I'm working on a project that uses Google Cloud Platform's App Engine in the Python 3 Flexible Environment using Django, and I'm trying to permanently redirect all requests over ht

Solution 1:

Setting secure in app.yaml only works for GAE Standard but not in Flexible. The app.yaml docs for Flexible do not mention this key at all.

You will probably have to do it on application level by inspecting the value of the X-Forwarded-Proto header. It will be set to https if the request to your app came by HTTPS. You can find more info on environment-provided headers in Flexible environment in the docs here.

Solution 2:

Make sure you have SecurityMiddleware and CommonMiddleware enabled, and assign a Base_URL:

settings.py:

MIDDLEWARE_CLASSES = (
    ...
    'django.middleware.security.SecurityMiddleware'
    'django.middleware.common.CommonMiddleware',    
)

BASE_URL = 'https://www.example.com'

Or, you could write your own middleware:

MIDDLEWARE_CLASSES = (
    ...
    'core.my_middleware.ForceHttps',
)

BASE_URL = 'https://www.example.com'

my_middleware.py:

from django.http import HttpResponsePermanentRedirect

classForceHttps(object):

    def process_request(self, request):

        if not (request.META.get('HTTPS') == 'on' and settings. BASE_URL == 'https://' + request.META.get('HTTP_HOST') ):
            return HttpResponsePermanentRedirect(settings. BASE_URL + request.META.get('PATH_INFO'))
        else:
            return None

Solution 3:

The issue is the header name. When accessing Django through a WSGI server, you should use the X-Forwarded-Proto header instead of the HTTP_X_FORWARDED_PROTO.

See: Why does django ignore HTTP_X_FORWARDED_PROTO from the wire but not in tests?

Solution 4:

I had a similar problem and tried a number changes both in the app.yaml and also in settings.py for a custom domain (with the default ssl cert supplied by GAE).

Through trial and error I found that in settings.py updating the allowed hosts to the appropriate domains had the desired result:

ALLOWED_HOSTS = ['https://{your-project-name}.appspot.com','https://www.yourcustomdomain.com'] 

Update: I am no longer sure the above is the reason as on a subsequent deploy the above was rejected and I was getting a hosts error. However the redirect is still in place... :(

Before this change I was able to switch between http:// and https:// manually in the address bar now it redirects automaticlly.

Solution 5:

In order to make this work both on App Engine Flexible and your local machine when testing, you should set the following in your settings.py

if os.getenv('GAE_INSTANCE'):
    SECURE_SSL_REDIRECT = True
    SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
else:
    # Running on your local machine
    SECURE_SSL_REDIRECT = False
    SECURE_PROXY_SSL_HEADER = None

That should be all you need to do to ensure that redirect is happening properly when you are on app engine.

NOTE: If you are using old school app engine cron jobs (via cron.yaml) then you will need to start using the much improved cloud scheduler instead. App engine cron jobs do not properly support redirection to HTTPS but you can easily get it working with cloud scheduler.