Proper way to enforce https only?

Phoenix Forum Questions / Help
,
25

I’m running into the same issue with GCP. I have a simple Phoenix app running on App Engine, but it’s not redirecting to https. I’ve tried all recommendations above, but nothing has worked for me.

Here is what I currently have in my config/releases.ex:

import Config

config :my_app, force_ssl: true

config :my_app, MyAppWeb.Endpoint,
  load_from_system_env: true,
  check_origin: false,
  server: true,
  root: ".",
  url: [scheme: "https", port: 443],
  cache_static_manifest: "priv/static/cache_manifest.json",
  force_ssl: [rewrite_on: [:x_forwarded_proto], hsts: true, host: nil]

When I run curl -s -D- http://my-app.com I get a 200 and the html response back, and when I run curl -s -D- https://my-app.com | grep -i Strict and get no output at all.

Can anyone help?

1 Like