Force https connection on certain pages

[catarak]

For Login/Signup, the user should be redirection to the https version of the site, and redirected back to the http version of the site once they are logged in, unless their initial connection is https.

[shiffman]

I'm not sure if this should be a separate issue, but some sketches require http and some require https. Some examples:

• accessing webcam or microphone require https
• APIs served over https require https
• APIs served over http require http

I don't have any great ideas as to how we should make this evident / selectable by users beyond just changing the URL in the address bar.

[catarak]

The nginx configuration has been updated so that if login, signup, or password reset are loaded sever side, they will be redirected to https. I still need to

1. Force the front end to render these pages https (i.e. force them to render server side)
2. Redirect to http again post authentication
3. Switch between http and https #170: have some interface for users to switch between http and https

[andrewn]

I've prototyped a quick approach to redirecting login to HTTPS on the client. The higher-order component detects if the protocol is HTTPS when mounting the view component and redirecting if not.

Getting the view to redirect back to the original protocol afterwards is a bit trickier since the app is loading from scratch on /login.

1. We could pass a query string such as /login?redirect=http to tell the app whether to reload on HTTP afterwards;
2. If we have a global flag in local storage of the user's preference for HTTP/S (perhaps set by Switch between http and https #170) then we could use that to determine where to redirect.

Does this approach make sense? Should I explore some alternatives?

[catarak]

This seems like the right direction to me!

I think that the preference for http vs. https actually needs to be set on a project basis, since depending on what the user wants to do for that specific sketch, they may need it to be http or https. But I think it this setting should be http by default.