Give projects the option to redirect all pages to https

[alex]

Rigth now RTD supports HTTPS for all URLs, but doesn't redirect docs links to it. It'd be great if tehre was an option for projects (maybe even defaulting to True for new projects), which let them specify "all my pages should redirect to HTTPS".

Long term I think RTD should just require HTTPS for all *.readthedocs.org URLs, but this seems like a pathway to get there.

[agjohnson]

Yes, we'd like to see https on everything. We need to dig more to see if we can do this without breaking the internet :)

[gregmuellegger]

I'm not sure if yet another option in the admin panel is desirable. Also are we using different nginx configs for every project? Because having a switch would require that, right?

We could give docs.readthedocs.org site a special config and force HTTPS there (with 301 permanent redirects) to see the impact that it might have and whether something breaks.

CNAME domains need to be excluded from the enforced HTTPS and would require a different solution (I'm not sure how, but seems like pip.pypa.io already enforces HTTPS).

[ericholscher]

pip and others doing SSL CNAME's are doing their own load balancing & SSL
term, so they are able to enforce it at that level. We are looking into
possibly offering CNAME SSL, but it would definitely be a paid feature
because of the overhead of managing the certs on our side.

I'd love to turn SSL on for all projects, but that would require proxying
all media through our SSL, or anything with any images/assets/etc pointed
at http URLs would get mixed content warnings.

On Fri, Jul 10, 2015 at 6:17 AM, Gregor Müllegger [email protected]
wrote:

I'm not sure if yet another option in the admin panel is desirable. Also
are we using different nginx configs for every project? Because having a
switch would require that, right?

We could give docs.readthedocs.org site a special config and force HTTPS
there (with 301 permanent redirects) to see the impact that it might have
and whether something breaks.

CNAME domains need to be excluded from the enforced HTTPS and would
require a different solution (I'm not sure how, but seems like pip.pypa.io
already enforces HTTPS).

—
Reply to this email directly or view it on GitHub
#1190 (comment)
.

Eric Holscher
Maker of the internet residing in Portland, Oregon
http://ericholscher.com

[humitos]

I think this can be considered done by #3987 and tracked by #3282 (comment)

I'm closing it, but feel free to re-open it if you consider.

[ericholscher]

It isn't done, we still aren't fully redirecting all web pages to HTTPS in nginx.

[davidfischer]

We are now redirecting HTTP -> HTTPS for all *.readthedocs.io domains. I think we can now close this.