https only in google app engine

Question

I am on a google app engine project now. In my application I have to allow only https protocol. And I have to restrict other protocols. It should allow https only. I have added the below code in web.xml.

<security-constraint>     <web-resource-collection>         <web-resource-name>Protected Area</web-resource-name>         <url-pattern>/*</url-pattern>     </web-resource-collection>     <user-data-constraint>         <transport-guarantee>CONFIDENTIAL</transport-guarantee>     </user-data-constraint> </security-constraint> 

But after deploying it works on both the protocols(http and https). How to restrict http?

Answer 1

It is possible to configure the individual handlers to require HTTPS in the app.yaml file in the WEB-INF folder as described here: Java Application Configuration Using app.yaml - Google App Engine.

You just have to add these two words to your app.yaml file under the appropriate url entry:
secure: always

For example:

- url: .*   script: main.app   secure: always 

Then if a user tries to access the URL with HTTP she will be automatically redirected to HTTPS. Pretty cool.