Double Redirect - https to http with trailing slashes

[mansona]

Hey folks 👋

I'm using this static build pack with https_only turned on. Our app is predominantly a set of index.html files in folders so that we can access them like this: https://example.com/post/a-lovely-blog-post/ which would then serve /post/a-lovely-blog-post/index.html as expected.

The problem is that when you navigate to https://example.com/post/a-lovely-blog-post (no trailing slash) it then redirects you to http://example.com/post/a-lovely-blog-post/ (trailing slash but http) which then redirects you again to https://example.com/post/a-lovely-blog-post/ (trailing slash and https) because of https_only

I can't quite track exactly where that intermediate 301 redirect is coming from (the one that adds the trailing slash but removes https). If someone could point me in the right direction I would be happy to introduce a PR to fix it 👍

[herrbuerger]

Sorry to dig this up, but we have the exact same problem currently. I was wondering if you have figured out how to solve this?

[mansona]

@herrbuerger this is one of two issues that I have open with Heroku and neither of them have had responses in over a year 😞 One of which actually has a PR that fixes the issue.

My only recommendation for you would be to look at alternative hosting possibilities. I have moved all my static stuff onto Netlify since none of the static buildpack issues seem to be getting any love

[herrbuerger]

@mansona thanks for the quick response.

I've spend some hours looking into that and the only thing that came up which might solve the problem is a new directive in later nginx versions absolute_redirect off; (see this).

But the nginx version used in the buildpack is ancient, so I'm currently evaluating if it makes sense for us to update it, though it's probably wiser to go directly with the nginx buildpack.

Big fan of Netlify and I'd move instantly if that was a possibility (which it isn't :()

[FaridSafi]

+1

[emrecan-s]

+1

[cyrilchapon]

Actually; I just discovered there is a much simpler issue.

https://a.com/b (without slash, with ssl)
redirects to
http://a.com/b/ (with slash, without ssl)
by default

The third redirection is caused by https_only: true indeed.

The "double redirect" is annoying indeed, but it's only an incidence of the main issue : The first automatic redirection is mandatory (no config to disable it), pretty annoying, and also so opiniated...

EDIT: And one should add "Opiniated" yes, but furthermore non-standard opinion.
A trailing slash after a host is a RFC; a trailing slash after a directory is nothing but an opinion

[holm]

This was confusing me today. It's very unfortunate that we need a redirect for all page loads.

[mikekreeki]

Same issue here, just noticed it, not very cool.

[holm]

This should be fixed by the change in #215. Would be nice to get merged.

[thesauri]

I encountered a similar issue for a host residing behind an nginx redirect. When visiting subdomains such as https://site.domain.foo/subpage, the user was redirected to http://site.herokuapp.com/subpage, and then to http://site.herokuapp.com/subpage/. In other words, the user was redirected away from site.domain.foo to the herokuapp domain.

I managed to solve this issue by using #215, so I would appreciate it being merged too (assuming there is no other way to do this that is more correct).

[edmorley]

Hi

This buildpack is now deprecated and we are recommending people move the more actively maintained heroku-buildpack-nginx. For migration advice see here.

As such, I'm closing this issue out since we won't be making further changes to this buildpack.