Heroku: Python Flask app - automatically redirecting from https to http <p>I'm writing an app for Facebook, which needs to be secure. The initial page, <a href="https://myapp.com" rel="nofollow">https://myapp.com</a>, loads perfectly fine.</p> <p>However when I click a link to <a href="https://myapp.com/link" rel="nofollow">https://myapp.com/link</a>, Chrome complains that the app is trying to load from an insecure source. I get the following message in the console:</p> <p>"[blocked] The page at '<a href="https://www.facebook.com/page/app_###" rel="nofollow">https://www.facebook.com/page/app_###</a>' was loaded over HTTPS, but ran insecure content from '<a href="http://myapp.com/link/" rel="nofollow">http://myapp.com/link/</a>': this content should also be loaded over HTTPS."</p> <p>Now the link is an absolute URL with the https prefix, yet apparently the page is trying to load from the http version.</p> <p>I visited the domain itself and checked the Network tab in the Chrome console to see what was happening. The following happens:</p> <ol> <li>The GET to <a href="https://myapp.com/link" rel="nofollow">https://myapp.com/link</a> is a 301, moved permanently.</li> <li>This then redirects to <a href="http://myapp.com/link" rel="nofollow">http://myapp.com/link</a></li> </ol> <p>As far as I can tell, there is nothing in my python code to make this happen, so I suspect some feature of Heroku is causing this, but I haven't been able to find anyone else with this problem.</p> <p>As a side note, I used Flask-SSLify to add a redirect back to the https version. This redirect works, but Chrome still blocks the page because it passes through the insecure version.</p>