-- Leo's gemini proxy
-- Connecting to capsule.adrianhesketh.com:1965...
-- Connected
-- Sending request
-- Meta line: 20 text/gemini; charset=utf-8
This week, I launched a new application, having bought a domain, setup a load balancer with an SSL certificate etc.
Unfortunately my new Go app didn't have a feature to redirect the user from HTTP to HTTPS automatically, meaning that it was possible for the user to send data without it being encrypted.
I needed my Go app to detect when the user was accessing the system over HTTP and get them to use HTTPS instead so I created some middleware to do it.
This is straightforward if the Go app is handling SSL itself, but in my case, I had the extra complexity of using an AWS Elastic Load Balancer (ELB) to manage the SSL for me - meaning that the Go application just sees incoming traffic.
The AWS ELB adds a HTTP header called X-Forwarded-Scheme to request which I can use to determine whether the incoming request was HTTP or HTTPS. So I used the [0] middleware to collect the value and pass it to the `[1] struct (`r.URL.Scheme`) making my middleware work for both scenarios.
Since I always want people to use HTTPS to access the system, I also added a HSTS header which sets user's browsers to automatically use HTTPS, even when presented with a HTTP URL in the future.
You can use it in your projects by the usual method of `go get github.com/a-h/hsts` - work with me on it at [2]
-- Response ended
-- Page fetched on Sun Apr 28 07:52:54 2024
