Proper way to enforce https only?

Set :force_ssl in your config/prod.exs and not config/releases.exs, as it is read at compile time. More recent Phoenix versions actually warn if you do this mistake.

FWIW, in my experience Plug.SSL, which is what Phoenix uses behind the scenes for force_ssl: [hsts: true], works fine.

It’s not working for me either. I’ve tried both what was in the phoenix guides and force_ssl: [hsts: true] and read the docs for Plug.SSL without seeing any clear reason it’s not working.

If I type in 应用宝官网-全网最新最热手机应用游戏下载, it loads with https. If I type 应用宝官网-全网最新最热手机应用游戏下载, it loads without. What I want is for the https route to load, even if the user doesn’t type https into the location bar of their browser.

I’m not using a proxy. It’s just a normal install of phoenix.

Here’s my prod.exs config:

config :myapp, Myapp.Endpoint,
  server: true,
  url: [scheme: "https", host: "myapp.com", port: 443],
  http: [compress: true, port: 80],
  https: [compress: true, port: 443,
  force_ssl: [hsts: true],
    otp_app: :myapp,
    keyfile: "/etc/letsencrypt/live/myapp.com/privkey.pem",
    certfile: "/etc/letsencrypt/live/myapp.com/cert.pem"],
  cache_static_manifest: "priv/static/manifest.json"