HTTP to HTTPS Redirects

When serving over HTTPS it is often desired (and wise) to redirect any HTTP requests to HTTPS. To do this Hypercorn must listen to requests on secure and insecure binds. This is possible using the insecure-bind option which specifies binds that will be insecure regardless of the SSL settings. For example,

$ hypercorn --certfile cert.pem --keyfile key.pem --bind localhost:443 --insecure-bind localhost:80 module:app

will serve on 443 over HTTPS and 80 over HTTP.

Warning

Care must be taken when serving over secure and insecure binds to ensure that only redirects are served over HTTP. Hypercorn will not and cannot ensure this for you.

Middleware

With Hypercorn listening on both secure and insecure binds middleware such as the one in the hypercorn middleware module, HTTPToHTTPSRedirectMiddleware, can be used to ensure HTTP requests are redirected to HTTPS. Alternatively you can do this directly in your ASGI application.

Warning

Ensure that any redirection middleware is the outermost wrapper of your app i.e. ensure that only the redirection middleware receives HTTP requests.

To use the HTTPToHTTPSRedirectMiddleware wrap your app and specify the host the redirects should be aimed at. If you want to redirect users from http://example.com to https://example.com the host should be example.com as in the example below,

redirected_app = HTTPToHTTPSRedirectMiddleware(app, host="example.com")

You can then serve the redirect_app over a secure and an insecure bind as explained above, for example,

$ hypercorn --certfile cert.pem --keyfile key.pem --bind localhost:443 --insecure-bind localhost:80 module:redirected_app