{"action":"created","issue":{"url":"https://api.github.com/repos/hackoregon/civic-devops/issues/215","repository_url":"https://api.github.com/repos/hackoregon/civic-devops","labels_url":"https://api.github.com/repos/hackoregon/civic-devops/issues/215/labels{/name}","comments_url":"https://api.github.com/repos/hackoregon/civic-devops/issues/215/comments","events_url":"https://api.github.com/repos/hackoregon/civic-devops/issues/215/events","html_url":"https://github.com/hackoregon/civic-devops/issues/215","id":345462268,"node_id":"MDU6SXNzdWUzNDU0NjIyNjg=","number":215,"title":"Redirect HTTP requests to HTTPS for APIs","user":{"login":"MikeTheCanuck","id":6953053,"node_id":"MDQ6VXNlcjY5NTMwNTM=","avatar_url":"https://avatars1.githubusercontent.com/u/6953053?v=4","gravatar_id":"","url":"https://api.github.com/users/MikeTheCanuck","html_url":"https://github.com/MikeTheCanuck","followers_url":"https://api.github.com/users/MikeTheCanuck/followers","following_url":"https://api.github.com/users/MikeTheCanuck/following{/other_user}","gists_url":"https://api.github.com/users/MikeTheCanuck/gists{/gist_id}","starred_url":"https://api.github.com/users/MikeTheCanuck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MikeTheCanuck/subscriptions","organizations_url":"https://api.github.com/users/MikeTheCanuck/orgs","repos_url":"https://api.github.com/users/MikeTheCanuck/repos","events_url":"https://api.github.com/users/MikeTheCanuck/events{/privacy}","received_events_url":"https://api.github.com/users/MikeTheCanuck/received_events","type":"User","site_admin":false},"labels":[{"id":843586561,"node_id":"MDU6TGFiZWw4NDM1ODY1NjE=","url":"https://api.github.com/repos/hackoregon/civic-devops/labels/Priority:%20medium","name":"Priority: medium","color":"e8ae02","default":false},{"id":1015570851,"node_id":"MDU6TGFiZWwxMDE1NTcwODUx","url":"https://api.github.com/repos/hackoregon/civic-devops/labels/blocked","name":"blocked","color":"f43fcd","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2018-07-28T16:43:45Z","updated_at":"2018-11-27T15:03:45Z","closed_at":null,"author_association":"COLLABORATOR","body":"## Goals\r\n1. redirect any HTTP protocol requests to the HTTPS listeners\r\n2. send routes and query params intact\r\n3. minimize the extra infrastructure - e.g. ideally perform the redirection at the ALB layer\r\n\r\n## Need for redirect\r\nThere are many industry-wide efforts to drive as much of the world's traffic to HTTPS (TLS-encrypted) channels and minimize the amount of traffic over HTTP (non-encrypted).  Google will be marking all HTTP pages \"insecure\" as of this year.\r\n\r\nIt would be preferable (especially as it's free, in an AWS world) to leverage HTTPS listeners - no questions there.\r\n\r\nGiven that all of Hack Oregon's infrastructure to date has been built on HTTP listeners (front end and APIs), there is a lot of legacy code that is hard-coded to send requests over HTTP.\r\n\r\nSo we will need to allow for incoming HTTP requests and redirect those requests to our HTTPS listeners.\r\n\r\n## Preserve routes and params\r\nFurther, I have noticed in many implementations of redirects that routes and query parameters can get dropped in the redirect, breaking the underlying application behaviour:\r\n* a request for http://service.civicpdx.org getting redirected to https://service.civicpdx.org would be fine\r\n* however, some redirecting implementations drop the routes, so that http://service.civicpdx.org/budget/ would just get redirected to https://service.civicpdx.org/ instead of https://service.civicpdx.org/budget/\r\n* further, I have also seen redirect implementations that drop the query parameters, so that a request for http://service.civicpdx.org/budget/ocrb/?fy=2015-16 would get redirected to https://service.civicpdx.org/budget/ocrb/ instead of https://service.civicpdx.org/budget/ocrb/?fy=2015-16\r\n\r\n## Minimize extra infrastructure\r\nIdeally it would be less overhead, and fewer points of failure, if the redirects were performed at the ALB layer (or some other \"hands-free\" AWS piece).  However, most [documents](https://aws.amazon.com/premiumsupport/knowledge-center/redirect-http-https-elb/) and [articles](https://www.reddit.com/r/aws/comments/7xsvsf/aws_application_load_balancer_can_it_redirect/) I'm finding in my research focus on implementing the redirecting listener as a web server module that you own yourself.  Having to account for, configure, manage and support another dozen web servers *just* for the purpose of sending traffic from HTTP to HTTPS seems like an awful burden, and given how common this need is, I can't accept that Amazon hasn't found a way to relieve this burden themselves."},"comment":{"url":"https://api.github.com/repos/hackoregon/civic-devops/issues/comments/442090511","html_url":"https://github.com/hackoregon/civic-devops/issues/215#issuecomment-442090511","issue_url":"https://api.github.com/repos/hackoregon/civic-devops/issues/215","id":442090511,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MjA5MDUxMQ==","user":{"login":"MikeTheCanuck","id":6953053,"node_id":"MDQ6VXNlcjY5NTMwNTM=","avatar_url":"https://avatars1.githubusercontent.com/u/6953053?v=4","gravatar_id":"","url":"https://api.github.com/users/MikeTheCanuck","html_url":"https://github.com/MikeTheCanuck","followers_url":"https://api.github.com/users/MikeTheCanuck/followers","following_url":"https://api.github.com/users/MikeTheCanuck/following{/other_user}","gists_url":"https://api.github.com/users/MikeTheCanuck/gists{/gist_id}","starred_url":"https://api.github.com/users/MikeTheCanuck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MikeTheCanuck/subscriptions","organizations_url":"https://api.github.com/users/MikeTheCanuck/orgs","repos_url":"https://api.github.com/users/MikeTheCanuck/repos","events_url":"https://api.github.com/users/MikeTheCanuck/events{/privacy}","received_events_url":"https://api.github.com/users/MikeTheCanuck/received_events","type":"User","site_admin":false},"created_at":"2018-11-27T15:03:45Z","updated_at":"2018-11-27T15:03:45Z","author_association":"COLLABORATOR","body":"And apparently this is a working example (haven’t read it, just filing away for later):\r\n\r\nhttps://stackoverflow.com/questions/52085478/aws-cloudformation-application-load-balancer-how-to-redirect-http-listener-to/53498717#53498717"}}
{"actor":{"display_login":"MikeTheCanuck"}}