title: Flask - Why are some endpoints not HTTPS?
body: <p>I am building a web app using Flask. Currently I am using Gunicorn to serve the application and nginx to act as a reverse-proxy. Chrome Dev tools is complaining that one endpoint are not HTTPS:</p>
  
  <blockquote>
    <p>Mixed Content: The page at '<a href="https://example.com:88/" rel="nofollow noreferrer">https://example.com:88/</a>' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint '<a href="http://example.com/geo2?coordinates=" rel="nofollow noreferrer">http://example.com/geo2?coordinates=</a>'. This request has been blocked; the content must be served over HTTPS.</p>
  </blockquote>
  
  <p>In app.py I've setup HTTPS for Flask:</p>
  
  <pre><code>context = ('ssl/server.crt', 'ssl/server.key')
  app.run(host='0.0.0.0', port=443, ssl_context=context, threaded=True, debug=True)
  </code></pre>
  
  <p>I am executing gunicorn with: </p>
  
  <pre><code>gunicorn --bind 0.0.0.0:8282 app:app
  </code></pre>
  
  <p>My nginx config (leaving out all the SSL settings for brevity): </p>
  
  <pre><code>server {
      listen 88 ssl;
      server_name example.com www.example.com;
      root /var/www/app/;
      index index.html;
  
  location / {
      proxy_pass         http://192.168.1.5:8282/;
      proxy_redirect     off;
      proxy_set_header   X-Real-IP $remote_addr;
      proxy_set_header   X-Forwarded-Host $server_name;
             }
  }
  </code></pre>
  
  <p>I noticed I am only seeing this error for one endpoint, /geo2. My app is set to redirect to this endpoint when it receives a POST request at /geo. The code for that is:</p>
  
  <p><code>return redirect(url_for('reload_index', coordinates=coordinates))</code></p>
  
  <p>The POST request is being sent by Ajax:</p>
  
  <pre><code>$.ajax({
      type: "POST",
      url: "/geo",
      contentType: "application/json; charset=utf-8",
      data: JSON.stringify(coordinates),
      dataType: "json",
      success: function(response) {
          console.log(response);
      },
      error: function(err) {
          console.log(err);
      }
  });
  </code></pre>
  
  <p>I'm confused as to why any endpoints are HTTP given that Flask is set to use HTTPS. What am I missing? I taught myself all of this within the last few months, so it's very possible I am overlooking something.</p>