title: How to properly enable HTTPS on App Engine flex environment and Go?
body: <p>I am trying to enable HTTPS on my Go App deployed to GAE flex environment. I have my custom domain successfully mapped, and am using Google-managed SSL certificates. I have app.yaml configured to redirect HTTP to HTTPS as follows:</p>
  
  <pre><code>handlers:
  - url: /.*
    script: _go_app
    secure: always
  </code></pre>
  
  <p>Now there are two problems that I haven't been able to resolve so far.</p>
  
  <p><strong>First</strong>, the above configuration is supposed to redirect HTTP traffic to HTTPS, but apparently it is not happening.</p>
  
  <p><strong>Second</strong>, when I add <code>https://</code> in the url box, I see three different behavior on Firefox, Chrome, and Edge. Edge identifies the website as secure, Firefox marks the website as secure connection, but says that it "has blocked parts of this page that are not secure", and surprisingly Chrome marks the website as Not secure (though it says certificate is valid!).</p>
  
  <p>With these symptoms I was wondering if I should take additional steps to make redirecting and SSL work for my website? Specifically, I would like to know with App Engine, and managed SSL enabled:</p>
  
  <ol>
  <li><p>Should I continue serving pages on HTTP using <code>http.ListenAndServe(..)</code>, or need to switch to <code>http.ListenAndServeTLS(..)</code>?</p></li>
  <li><p>In my Go app should I redirect HTTP to HTTPS? or the above setting is expected to work just fine?</p></li>
  </ol>
  
  <p>Thanks in advance for your help and advice.</p>
  
  <p>PS:
  Trying out with different suggestions, I added <code>Strict-Transport-Security: max-age=31536000; includeSubDomains</code> to handlers' response. Does not seem if this helped with redirection either.</p>
  
  <p><strong>EDIT/PARTIAL ANSWER:</strong></p>
  
  <p>According to this <a href="https://cloud.google.com/appengine/docs/flexible/go/upgrading" rel="nofollow noreferrer">documentation</a>, under <strong>Authentication changes</strong>, the <code>secure</code> and <code>login</code> handlers are deprecated. The documentation suggests using <code>Strict-Transport-Security</code> or <code>X-Forwarded-Proto</code> instead.</p>
  
  <p>I am using <code>Strict-Transport-Security</code> on the server side to enrich my response header:</p>
  
  <pre><code>func (h *STLHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
      w.Header().Add("Strict-Transport-Security", "max-age=63072000; includeSubDomains")
      h.nextHandler.ServeHTTP(w, req)
  }
  </code></pre>
  
  <p>I was wondering if I am using this header in the right place?</p>