Forcing HTTPS responses? Attempts to fix ATS errors

[raphaelschaad]

Is forcing HTTPS responses a good idea? https://medium.com/@connorlurring/fixing-nuts-auto-updates-for-our-electron-app-64beeed8b14 /by @connorlurring

The author attempts to fix Apple Transport Security (ATS) errors when the an Electron client requests the update through HTTPS but then the nuts deployment setup (Heroku in this case) returns an HTTP URL. /cc @SamyPesse @AaronO

[ogtfaber]

You can solve this by setting TRUST_PROXY to true in Heroku

See #163 (comment)

[connorlurring]

Hi @raphaelschaad thanks for taking the time to critically evaluate my article!

While forcing HTTPS isn't the optimal solution, it has worked for my use case since that article was written, with no unforeseen issues.

That said, thanks @ogtfaber for bringing #163 to my attention. TRUST_PROXY sounds like a valid solution, I plan to amend the article shortly to recommend it. I wasn't aware that there was a commonplace solution for trusting the proxy in a situation like this, and the original solution was based on the Heroku documentation not having any reference to this config var.

It seems that TRUST_PROXY is a commonly used configuration for a variety of products, and should be more generally suitable as advice, leaving the original functionality of the library unchanged.

[raphaelschaad]

Thanks @ogtfaber for the solution, I have since adopted it. And thanks @connorlurring for updating your post for everyone else, given you're the top result I found googling the problem. You can point to the relevant bits of Nuts' docs. Closing this issue.