HTTP to HTTPS redirection on App Engine Flexible

Question

I've followed the answer of this: Redirect from http to https in google cloud but it does not seem to be currently accurate any more. The anchor referenced ( https://cloud.google.com/appengine/docs/flexible/nodejs/configuring-your-app-with-app-yaml#security ) seems to have been removed but without a note of a replacement.

For reference, I am serving NodeJS over a Google App (flex) Engine. As per the answer I've got in my app.yaml:

handlers:
- url: /.*
  script: IGNORED
  secure: always

Since HTTPS is obviously terminated before it hits my Express engine (and redirection on there would be useless); how is it currently correctly implemented?

Potentially helpful, I have an external domain attached via the "Custom domains" tab in the console, and there is indeed a SSL certificate configured (so if a user manually goes to https://.com everything is fine)

Answer 1

The flexible environment does not current support handlers in the app.yaml. If you want https:// redirection, you have a few options:

• Use helmet to do to HSTS stuff for you, and implement your own initial redirect.
• I wrote a happy little library to always forces SSL on all routes for express yes-https

We are considering auto-redirecting all traffic to SSL by default. Do you think that would be a good thing for your apps?