HTTPS -> HTTP redirect in URLs missing a trailing slash

[davidfischer]

Under some circumstances, we are redirecting docs from HTTPS -> HTTP. We basically never want to do this.

$ curl -IL https://flask.palletsprojects.com/en/1.1.x/api
HTTP/2 301
...
location: http://flask.palletsprojects.com/en/1.1.x/api/
...

This is most visible with dirhtml builds where a trailing slash is often omitted and curling https://flask.palletsprojects.com/en/1.1.x/api/ directly is fine. This affects subdomain docs too (*.readthedocs.io) but in a different manner (HTTPS -> HTTP -> HTTPS again):

$ curl -IL https://flask.readthedocs.io/en/1.1.x/api
HTTP/1.1 301 Moved Permanently
...
Location: http://flask.readthedocs.io/en/1.1.x/api/
...

HTTP/1.1 301 Moved Permanently
...
Location: https://flask.readthedocs.io/en/1.1.x/api/
...

It affects non-dirhtml docs as well although it isn't as visible because the issue is hit pretty infrequently because most requests end with .html:

$ curl -IL https://docs.readthedocs.io/en/stable/config-file
HTTP/1.1 301 Moved Permanently
...
Location: http://docs.readthedocs.io/en/stable/config-file/

My current best guess is that this is due to the nginx try_files directive using the first listener which is port 80. For subdomain docs, we have a blanket HTTP -> HTTPS redirect so this problem is masked although not really resolved. We can't do a blanket redirect for all custom domains because many people have not correctly setup their custom domain such that RTD can issue a certificate. (see #4641)

This also affects the redirects in place for $lang/$version:

$ curl -IL https://docs.readthedocs.io/en/stable
HTTP/1.1 301 Moved Permanently
...
Location: http://docs.readthedocs.io/en/stable/
...

[davidfischer]

Based on my reading, I think the fix may be to turn absolute_redirect off; in nginx. It looks like nginx issues redirects under some circumstances and it uses the same $scheme as the request. Since SSL is terminated at the load balancer, the $scheme is http rather than https.

[Patil2099]

@davidfischer Can I work on this issue?

[stsewd]

@Patil2099 this requires access to our ops repo, that repo is private.

[davidfischer]

We rolled the fix out to this this week (absolute_redirect off) and it seems to be working without issue.