How to redirect API calls from HTTP to HTTPS #15

New Issue

Ghost · 2019-11-06T17:56:50Z

Ghost commented

2019-11-06 17:56:50 +00:00

Using greenlock-express v3 to serve my website; i have an API and currently my API client (RestSharp) fails as receives an HTML with the http-equiv redirect to https....

There is some way (cannot find on docs) to make greenlock-express to send an HTTP 301 with the https location?

Thanks!

Using greenlock-express v3 to serve my website; i have an API and currently my API client (RestSharp) fails as receives an HTML with the <META> http-equiv redirect to https.... There is some way (cannot find on docs) to make greenlock-express to send an HTTP 301 with the https location? Thanks!

coolaj86 commented

2019-11-06 18:15:01 +00:00

Yes, but I’m on my phone so I’ll give a quick response now and follow up later:

You can, but you would be purposefully defeating the security feature that was put in exactly for this use case.

API clients SHOULD NOT follow HTTP -> HTTPs redirects.

That exposes API tokens publicly to anyone on the network.

Instead, the API client should be fixed to use HTTPS urls for HTTPS apis.

Yes, but I’m on my phone so I’ll give a quick response now and follow up later: You can, but you would be purposefully defeating the security feature that was put in exactly for this use case. API clients SHOULD NOT follow HTTP -> HTTPs redirects. That exposes API tokens publicly to anyone on the network. Instead, the API client should be fixed to use HTTPS urls for HTTPS apis.

Ghost commented

2019-11-06 18:53:20 +00:00

My problem is, my clients should work with HTTP while i'm migrating them to https (hundreds of clients which i must manually update...)

Giving an error while the migration is in progress in NOT AN OPTION! I must continue to respond on HTTP, and also respond on HTTPS.

When all my REST clients are fully going to HTTPS and nobody uses HTTP in that specific API, then i can finally remove that "temporary redirect"

My problem is, my clients should work with HTTP while i'm migrating them to https (hundreds of clients which i must manually update...) Giving an error while the migration is in progress in NOT AN OPTION! I must continue to respond on HTTP, and also respond on HTTPS. When all my REST clients are fully going to HTTPS and nobody uses HTTP in that specific API, then i can finally remove that "temporary redirect"

coolaj86 commented

2019-11-06 18:59:41 +00:00

Check out the http example in the examples folder.

You can pass in your own instance of redirect-https with the meta option turned off.

Or you can write your own redirector as a normal http app.

Check out the http example in the examples folder. You can pass in your own instance of `redirect-https` with the meta option turned off. Or you can write your own redirector as a normal http app.

Sign in to join this conversation.

No Label

No Milestone

No Assignees

2 Participants

Notifications

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: root/greenlock-express.js#15