HTTP to HTTPS Redirects#
When serving over HTTPS it is often desired (and wise) to redirect any
HTTP requests to HTTPS. To do this Hypercorn must listen to requests
on secure and insecure binds. This is possible using the
insecure-bind
option which specifies binds that will be insecure
regardless of the SSL settings. For example,
$ hypercorn --certfile cert.pem --keyfile key.pem --bind localhost:443 --insecure-bind localhost:80 module:app
will serve on 443 over HTTPS and 80 over HTTP.
Warning
Care must be taken when serving over secure and insecure binds to ensure that only redirects are served over HTTP. Hypercorn will not and cannot ensure this for you.
Middleware#
With Hypercorn listening on both secure and insecure binds middleware
such as the one in the hypercorn middleware module,
HTTPToHTTPSRedirectMiddleware
, can be
used to ensure HTTP requests are redirected to HTTPS. Alternatively
you can do this directly in your ASGI application.
Warning
Ensure that any redirection middleware is the outermost wrapper of your app i.e. ensure that only the redirection middleware receives HTTP requests.
To use the HTTPToHTTPSRedirectMiddleware
wrap your app and specify
the host the redirects should be aimed at. If you want to redirect
users from http://example.com
to https://example.com
the host should
be example.com
as in the example below,
redirected_app = HTTPToHTTPSRedirectMiddleware(app, host="example.com")
You can then serve the redirect_app over a secure and an insecure bind as explained above, for example,
$ hypercorn --certfile cert.pem --keyfile key.pem --bind localhost:443 --insecure-bind localhost:80 module:redirected_app