root/greenlock-express.js
2
1
Fork 0
mirror of https://github.com/therootcompany/greenlock-express.js.git synced 2025-04-21 06:40:37 +00:00
Code Issues 43 Releases Wiki Activity

How to redirect API calls from HTTP to HTTPS #15

New Issue
Open
opened 2019-11-06 17:56:50 +00:00 by Ghost · 3 comments
Ghost commented 2019-11-06 17:56:50 +00:00
Copy Link

Using greenlock-express v3 to serve my website; i have an API and currently my API client (RestSharp) fails as receives an HTML with the http-equiv redirect to https....

There is some way (cannot find on docs) to make greenlock-express to send an HTTP 301 with the https location?

Thanks!

Using greenlock-express v3 to serve my website; i have an API and currently my API client (RestSharp) fails as receives an HTML with the <META> http-equiv redirect to https.... There is some way (cannot find on docs) to make greenlock-express to send an HTTP 301 with the https location? Thanks!
coolaj86 commented 2019-11-06 18:15:01 +00:00
Owner
Copy Link

Yes, but I’m on my phone so I’ll give a quick response now and follow up later:

You can, but you would be purposefully defeating the security feature that was put in exactly for this use case.

API clients SHOULD NOT follow HTTP -> HTTPs redirects.

That exposes API tokens publicly to anyone on the network.

Instead, the API client should be fixed to use HTTPS urls for HTTPS apis.

Yes, but I’m on my phone so I’ll give a quick response now and follow up later: You can, but you would be purposefully defeating the security feature that was put in exactly for this use case. API clients SHOULD NOT follow HTTP -> HTTPs redirects. That exposes API tokens publicly to anyone on the network. Instead, the API client should be fixed to use HTTPS urls for HTTPS apis.
Ghost commented 2019-11-06 18:53:20 +00:00
Author
Copy Link

My problem is, my clients should work with HTTP while i'm migrating them to https (hundreds of clients which i must manually update...)

Giving an error while the migration is in progress in NOT AN OPTION! I must continue to respond on HTTP, and also respond on HTTPS.

When all my REST clients are fully going to HTTPS and nobody uses HTTP in that specific API, then i can finally remove that "temporary redirect"

My problem is, my clients should work with HTTP while i'm migrating them to https (hundreds of clients which i must manually update...) Giving an error while the migration is in progress in NOT AN OPTION! I must continue to respond on HTTP, and also respond on HTTPS. When all my REST clients are fully going to HTTPS and nobody uses HTTP in that specific API, then i can finally remove that "temporary redirect"
coolaj86 commented 2019-11-06 18:59:41 +00:00
Owner
Copy Link

Check out the http example in the examples folder.

You can pass in your own instance of redirect-https with the meta option turned off.

Or you can write your own redirector as a normal http app.

Check out the http example in the examples folder. You can pass in your own instance of `redirect-https` with the meta option turned off. Or you can write your own redirector as a normal http app.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Assignees
Clear assignees
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: root/greenlock-express.js#15
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?