{"action":"created","comment":{"url":"https://api.github.com/repos/begriffs/postgrest/pulls/comments/44087739","id":44087739,"diff_hunk":"@@ -54,26 +50,14 @@ runWithClaims conf app req = do\n             else setRole anon : jwtEnv\n    jwtEnv = claimsToSQL claims\n \n-redirectInsecure :: Application -> Application\n-redirectInsecure app req respond = do\n-  let hdrs = requestHeaders req\n-      host = lookup \"host\" hdrs\n-      uriM = parseURI . cs =<< mconcat [\n-        Just \"https://\",\n-        host,\n-        Just $ rawPathInfo req,\n-        Just $ rawQueryString req]\n-      isHerokuSecure = lookup \"x-forwarded-proto\" hdrs == Just \"https\"\n-\n+checkInsecure :: Application -> Application\n+checkInsecure app req respond =\n   if not (isSecure req || isHerokuSecure)\n-    then case uriM of\n-      Just uri ->\n-        respond $ responseLBS status301 [\n-            (hLocation, cs . show $ uri { uriScheme = \"https:\" })\n-          ] \"\"\n-      Nothing ->\n-        respond $ responseLBS status400 [] \"SSL is required\"\n+    then respond $ responseLBS status403 [] \"SSL is required\"","path":"src/PostgREST/Middleware.hs","position":48,"original_position":48,"commit_id":"34c153086ca24a8a77adf7216fd7526888febf39","original_commit_id":"34c153086ca24a8a77adf7216fd7526888febf39","user":{"login":"begriffs","id":911911,"avatar_url":"https://avatars.githubusercontent.com/u/911911?v=3","gravatar_id":"","url":"https://api.github.com/users/begriffs","html_url":"https://github.com/begriffs","followers_url":"https://api.github.com/users/begriffs/followers","following_url":"https://api.github.com/users/begriffs/following{/other_user}","gists_url":"https://api.github.com/users/begriffs/gists{/gist_id}","starred_url":"https://api.github.com/users/begriffs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/begriffs/subscriptions","organizations_url":"https://api.github.com/users/begriffs/orgs","repos_url":"https://api.github.com/users/begriffs/repos","events_url":"https://api.github.com/users/begriffs/events{/privacy}","received_events_url":"https://api.github.com/users/begriffs/received_events","type":"User","site_admin":false},"body":"Maybe a json object matching the other postgrest error messages, like\r\n\r\n```json\r\n{ \"message\": \"SSL is required\" }\r\n```","created_at":"2015-11-05T23:59:18Z","updated_at":"2015-11-05T23:59:18Z","html_url":"https://github.com/begriffs/postgrest/pull/345#discussion_r44087739","pull_request_url":"https://api.github.com/repos/begriffs/postgrest/pulls/345","_links":{"self":{"href":"https://api.github.com/repos/begriffs/postgrest/pulls/comments/44087739"},"html":{"href":"https://github.com/begriffs/postgrest/pull/345#discussion_r44087739"},"pull_request":{"href":"https://api.github.com/repos/begriffs/postgrest/pulls/345"}}},"pull_request":{"url":"https://api.github.com/repos/begriffs/postgrest/pulls/345","id":49892319,"html_url":"https://github.com/begriffs/postgrest/pull/345","diff_url":"https://github.com/begriffs/postgrest/pull/345.diff","patch_url":"https://github.com/begriffs/postgrest/pull/345.patch","issue_url":"https://api.github.com/repos/begriffs/postgrest/issues/345","number":345,"state":"open","locked":false,"title":"Do not redirect insecure requests","user":{"login":"calebmer","id":8282507,"avatar_url":"https://avatars.githubusercontent.com/u/8282507?v=3","gravatar_id":"","url":"https://api.github.com/users/calebmer","html_url":"https://github.com/calebmer","followers_url":"https://api.github.com/users/calebmer/followers","following_url":"https://api.github.com/users/calebmer/following{/other_user}","gists_url":"https://api.github.com/users/calebmer/gists{/gist_id}","starred_url":"https://api.github.com/users/calebmer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/calebmer/subscriptions","organizations_url":"https://api.github.com/users/calebmer/orgs","repos_url":"https://api.github.com/users/calebmer/repos","events_url":"https://api.github.com/users/calebmer/events{/privacy}","received_events_url":"https://api.github.com/users/calebmer/received_events","type":"User","site_admin":false},"body":"I was recently doing research and came across [this](https://github.com/interagent/http-api-design#require-secure-connections). I'll quote the relevant sections here:\r\n\r\n> ### Require Secure Connections\r\n>\r\n> Require secure connections with TLS to access the API, without exception. It’s not worth trying to figure out or explain when it is OK to use TLS and when it’s not. Just require TLS for everything.\r\n>\r\n> Ideally, simply reject any non-TLS requests by not responding to requests for http or port 80 to avoid any insecure data exchange. In environments where this is not possible, respond with `403 Forbidden`.\r\n>\r\n> **Redirects are discouraged** since they allow sloppy/bad client behaviour without providing any clear gain. Clients that rely on redirects double up on server traffic and render TLS useless since sensitive data will already have been exposed during the first call.\r\n\r\nLet's discuss potentially not redirecting (as is recommended in the last paragraph) and just responding with a 403. I like the idea 😊","created_at":"2015-11-05T22:46:53Z","updated_at":"2015-11-05T23:59:18Z","closed_at":null,"merged_at":null,"merge_commit_sha":"9bd6fe2004967c9daaa508d25d92ad1f862f3b6b","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/begriffs/postgrest/pulls/345/commits","review_comments_url":"https://api.github.com/repos/begriffs/postgrest/pulls/345/comments","review_comment_url":"https://api.github.com/repos/begriffs/postgrest/pulls/comments{/number}","comments_url":"https://api.github.com/repos/begriffs/postgrest/issues/345/comments","statuses_url":"https://api.github.com/repos/begriffs/postgrest/statuses/34c153086ca24a8a77adf7216fd7526888febf39","head":{"label":"calebmer:feature/insecure-forbidden","ref":"feature/insecure-forbidden","sha":"34c153086ca24a8a77adf7216fd7526888febf39","user":{"login":"calebmer","id":8282507,"avatar_url":"https://avatars.githubusercontent.com/u/8282507?v=3","gravatar_id":"","url":"https://api.github.com/users/calebmer","html_url":"https://github.com/calebmer","followers_url":"https://api.github.com/users/calebmer/followers","following_url":"https://api.github.com/users/calebmer/following{/other_user}","gists_url":"https://api.github.com/users/calebmer/gists{/gist_id}","starred_url":"https://api.github.com/users/calebmer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/calebmer/subscriptions","organizations_url":"https://api.github.com/users/calebmer/orgs","repos_url":"https://api.github.com/users/calebmer/repos","events_url":"https://api.github.com/users/calebmer/events{/privacy}","received_events_url":"https://api.github.com/users/calebmer/received_events","type":"User","site_admin":false},"repo":{"id":43010742,"name":"postgrest","full_name":"calebmer/postgrest","owner":{"login":"calebmer","id":8282507,"avatar_url":"https://avatars.githubusercontent.com/u/8282507?v=3","gravatar_id":"","url":"https://api.github.com/users/calebmer","html_url":"https://github.com/calebmer","followers_url":"https://api.github.com/users/calebmer/followers","following_url":"https://api.github.com/users/calebmer/following{/other_user}","gists_url":"https://api.github.com/users/calebmer/gists{/gist_id}","starred_url":"https://api.github.com/users/calebmer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/calebmer/subscriptions","organizations_url":"https://api.github.com/users/calebmer/orgs","repos_url":"https://api.github.com/users/calebmer/repos","events_url":"https://api.github.com/users/calebmer/events{/privacy}","received_events_url":"https://api.github.com/users/calebmer/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/calebmer/postgrest","description":"REST API for any Postgres database","fork":true,"url":"https://api.github.com/repos/calebmer/postgrest","forks_url":"https://api.github.com/repos/calebmer/postgrest/forks","keys_url":"https://api.github.com/repos/calebmer/postgrest/keys{/key_id}","collaborators_url":"https://api.github.com/repos/calebmer/postgrest/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/calebmer/postgrest/teams","hooks_url":"https://api.github.com/repos/calebmer/postgrest/hooks","issue_events_url":"https://api.github.com/repos/calebmer/postgrest/issues/events{/number}","events_url":"https://api.github.com/repos/calebmer/postgrest/events","assignees_url":"https://api.github.com/repos/calebmer/postgrest/assignees{/user}","branches_url":"https://api.github.com/repos/calebmer/postgrest/branches{/branch}","tags_url":"https://api.github.com/repos/calebmer/postgrest/tags","blobs_url":"https://api.github.com/repos/calebmer/postgrest/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/calebmer/postgrest/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/calebmer/postgrest/git/refs{/sha}","trees_url":"https://api.github.com/repos/calebmer/postgrest/git/trees{/sha}","statuses_url":"https://api.github.com/repos/calebmer/postgrest/statuses/{sha}","languages_url":"https://api.github.com/repos/calebmer/postgrest/languages","stargazers_url":"https://api.github.com/repos/calebmer/postgrest/stargazers","contributors_url":"https://api.github.com/repos/calebmer/postgrest/contributors","subscribers_url":"https://api.github.com/repos/calebmer/postgrest/subscribers","subscription_url":"https://api.github.com/repos/calebmer/postgrest/subscription","commits_url":"https://api.github.com/repos/calebmer/postgrest/commits{/sha}","git_commits_url":"https://api.github.com/repos/calebmer/postgrest/git/commits{/sha}","comments_url":"https://api.github.com/repos/calebmer/postgrest/comments{/number}","issue_comment_url":"https://api.github.com/repos/calebmer/postgrest/issues/comments{/number}","contents_url":"https://api.github.com/repos/calebmer/postgrest/contents/{+path}","compare_url":"https://api.github.com/repos/calebmer/postgrest/compare/{base}...{head}","merges_url":"https://api.github.com/repos/calebmer/postgrest/merges","archive_url":"https://api.github.com/repos/calebmer/postgrest/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/calebmer/postgrest/downloads","issues_url":"https://api.github.com/repos/calebmer/postgrest/issues{/number}","pulls_url":"https://api.github.com/repos/calebmer/postgrest/pulls{/number}","milestones_url":"https://api.github.com/repos/calebmer/postgrest/milestones{/number}","notifications_url":"https://api.github.com/repos/calebmer/postgrest/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/calebmer/postgrest/labels{/name}","releases_url":"https://api.github.com/repos/calebmer/postgrest/releases{/id}","created_at":"2015-09-23T15:46:51Z","updated_at":"2015-10-11T20:26:59Z","pushed_at":"2015-11-05T22:43:10Z","git_url":"git://github.com/calebmer/postgrest.git","ssh_url":"git@github.com:calebmer/postgrest.git","clone_url":"https://github.com/calebmer/postgrest.git","svn_url":"https://github.com/calebmer/postgrest","homepage":"","size":831,"stargazers_count":1,"watchers_count":1,"language":"Haskell","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":1,"default_branch":"master"}},"base":{"label":"begriffs:v3","ref":"v3","sha":"4803d7c8283ae18f3e611eb87930e6fd27769995","user":{"login":"begriffs","id":911911,"avatar_url":"https://avatars.githubusercontent.com/u/911911?v=3","gravatar_id":"","url":"https://api.github.com/users/begriffs","html_url":"https://github.com/begriffs","followers_url":"https://api.github.com/users/begriffs/followers","following_url":"https://api.github.com/users/begriffs/following{/other_user}","gists_url":"https://api.github.com/users/begriffs/gists{/gist_id}","starred_url":"https://api.github.com/users/begriffs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/begriffs/subscriptions","organizations_url":"https://api.github.com/users/begriffs/orgs","repos_url":"https://api.github.com/users/begriffs/repos","events_url":"https://api.github.com/users/begriffs/events{/privacy}","received_events_url":"https://api.github.com/users/begriffs/received_events","type":"User","site_admin":false},"repo":{"id":20787122,"name":"postgrest","full_name":"begriffs/postgrest","owner":{"login":"begriffs","id":911911,"avatar_url":"https://avatars.githubusercontent.com/u/911911?v=3","gravatar_id":"","url":"https://api.github.com/users/begriffs","html_url":"https://github.com/begriffs","followers_url":"https://api.github.com/users/begriffs/followers","following_url":"https://api.github.com/users/begriffs/following{/other_user}","gists_url":"https://api.github.com/users/begriffs/gists{/gist_id}","starred_url":"https://api.github.com/users/begriffs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/begriffs/subscriptions","organizations_url":"https://api.github.com/users/begriffs/orgs","repos_url":"https://api.github.com/users/begriffs/repos","events_url":"https://api.github.com/users/begriffs/events{/privacy}","received_events_url":"https://api.github.com/users/begriffs/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/begriffs/postgrest","description":"REST API for any Postgres database","fork":false,"url":"https://api.github.com/repos/begriffs/postgrest","forks_url":"https://api.github.com/repos/begriffs/postgrest/forks","keys_url":"https://api.github.com/repos/begriffs/postgrest/keys{/key_id}","collaborators_url":"https://api.github.com/repos/begriffs/postgrest/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/begriffs/postgrest/teams","hooks_url":"https://api.github.com/repos/begriffs/postgrest/hooks","issue_events_url":"https://api.github.com/repos/begriffs/postgrest/issues/events{/number}","events_url":"https://api.github.com/repos/begriffs/postgrest/events","assignees_url":"https://api.github.com/repos/begriffs/postgrest/assignees{/user}","branches_url":"https://api.github.com/repos/begriffs/postgrest/branches{/branch}","tags_url":"https://api.github.com/repos/begriffs/postgrest/tags","blobs_url":"https://api.github.com/repos/begriffs/postgrest/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/begriffs/postgrest/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/begriffs/postgrest/git/refs{/sha}","trees_url":"https://api.github.com/repos/begriffs/postgrest/git/trees{/sha}","statuses_url":"https://api.github.com/repos/begriffs/postgrest/statuses/{sha}","languages_url":"https://api.github.com/repos/begriffs/postgrest/languages","stargazers_url":"https://api.github.com/repos/begriffs/postgrest/stargazers","contributors_url":"https://api.github.com/repos/begriffs/postgrest/contributors","subscribers_url":"https://api.github.com/repos/begriffs/postgrest/subscribers","subscription_url":"https://api.github.com/repos/begriffs/postgrest/subscription","commits_url":"https://api.github.com/repos/begriffs/postgrest/commits{/sha}","git_commits_url":"https://api.github.com/repos/begriffs/postgrest/git/commits{/sha}","comments_url":"https://api.github.com/repos/begriffs/postgrest/comments{/number}","issue_comment_url":"https://api.github.com/repos/begriffs/postgrest/issues/comments{/number}","contents_url":"https://api.github.com/repos/begriffs/postgrest/contents/{+path}","compare_url":"https://api.github.com/repos/begriffs/postgrest/compare/{base}...{head}","merges_url":"https://api.github.com/repos/begriffs/postgrest/merges","archive_url":"https://api.github.com/repos/begriffs/postgrest/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/begriffs/postgrest/downloads","issues_url":"https://api.github.com/repos/begriffs/postgrest/issues{/number}","pulls_url":"https://api.github.com/repos/begriffs/postgrest/pulls{/number}","milestones_url":"https://api.github.com/repos/begriffs/postgrest/milestones{/number}","notifications_url":"https://api.github.com/repos/begriffs/postgrest/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/begriffs/postgrest/labels{/name}","releases_url":"https://api.github.com/repos/begriffs/postgrest/releases{/id}","created_at":"2014-06-13T00:23:00Z","updated_at":"2015-11-04T17:32:35Z","pushed_at":"2015-11-05T22:46:54Z","git_url":"git://github.com/begriffs/postgrest.git","ssh_url":"git@github.com:begriffs/postgrest.git","clone_url":"https://github.com/begriffs/postgrest.git","svn_url":"https://github.com/begriffs/postgrest","homepage":"","size":4272,"stargazers_count":5707,"watchers_count":5707,"language":"Haskell","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":177,"mirror_url":null,"open_issues_count":48,"forks":177,"open_issues":48,"watchers":5707,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/begriffs/postgrest/pulls/345"},"html":{"href":"https://github.com/begriffs/postgrest/pull/345"},"issue":{"href":"https://api.github.com/repos/begriffs/postgrest/issues/345"},"comments":{"href":"https://api.github.com/repos/begriffs/postgrest/issues/345/comments"},"review_comments":{"href":"https://api.github.com/repos/begriffs/postgrest/pulls/345/comments"},"review_comment":{"href":"https://api.github.com/repos/begriffs/postgrest/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/begriffs/postgrest/pulls/345/commits"},"statuses":{"href":"https://api.github.com/repos/begriffs/postgrest/statuses/34c153086ca24a8a77adf7216fd7526888febf39"}}}}