Proxito: redirect http->https for public domains #10142
Conversation
readthedocs/proxito/views/serve.py
Outdated
| if ( | ||
| unresolved_domain.is_from_public_domain | ||
| or unresolved_domain.is_from_external_domain | ||
| ): | ||
| if settings.PUBLIC_DOMAIN_USES_HTTPS and not request.is_secure(): | ||
| # Redirect HTTP -> HTTPS (302) for public domains. | ||
| return RedirectType.http_to_https | ||
|
|
There was a problem hiding this comment.
I think we should probably move the https redirects to the middleware, since we want all traffic to redirect to https, not just doc pages.
There was a problem hiding this comment.
Doesn't Django ship with middleware to do this?
https://docs.djangoproject.com/en/4.1/ref/settings/#std-setting-SECURE_SSL_REDIRECT
There was a problem hiding this comment.
But we need to take custom domains into consideration, we can't redirect everything
There was a problem hiding this comment.
or at leas in .org, in .com we were redirecting all custom domains.
There was a problem hiding this comment.
I think now that we have automatic SSL configuration, we should be able to auto-redirect to SSL everywhere? I think we probably want to migrate to only serving on SSL, so this seems like a reasonable step to take? But I agree, we want to make sure we're taking into account the domain.ssl variable so we don't break things in the transition.
There was a problem hiding this comment.
We can probably inherit from the Django one and modify it a little to consider domain.ssl. I like re-using starndard Django stuffs :)
readthedocs/proxito/views/serve.py
Outdated
| if ( | ||
| unresolved_domain.is_from_public_domain | ||
| or unresolved_domain.is_from_external_domain | ||
| ): | ||
| if settings.PUBLIC_DOMAIN_USES_HTTPS and not request.is_secure(): | ||
| # Redirect HTTP -> HTTPS (302) for public domains. | ||
| return RedirectType.http_to_https | ||
|
|
There was a problem hiding this comment.
Doesn't Django ship with middleware to do this?
https://docs.djangoproject.com/en/4.1/ref/settings/#std-setting-SECURE_SSL_REDIRECT
The current nginx implementation redirects all requests (from public domains for .org and public and custom domains on .com), not just docs pages #10144 |
No description provided.