Openshift redirect to https using flask-base example

Question

I'm trying to run my flask based app on free gear on Openshift only on https. Following this - I have added the .htaccess file to the root of my repo but it seems to be ignored, as it is not redirecting. The article talks about a wsgi directory but I have none, so I'm not sure about the place. I have created the app using this example:

$cat .htaccess 

RewriteEngine on
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R,L]

Answer 1

My understanding for the OpenShift setup is that the .htaccess file can only be used in conjunction with static files and not the dynamic part of your application. To use the standard Apache/mod_wsgi setup you would have to instead use a WSGI middleware that wraps your Flask application to force the redirection.

The only alternative I can offer is that you side step the standard Apache/mod_wsgi installation they provide and instead use mod_wsgi-express as outlined in:

• http://blog.dscpl.com.au/2015/01/using-alternative-wsgi-servers-with.html

When using mod_wsgi-express then I would be able to explain a way of adding an additional Apache configuration snippet to trigger the redirection.

---

UPDATE 1

FWIW, my understanding that this would only be possible for the 'wsgi/static' directory in the older style of setting up OpenShift was because the actual WSGI application would have been mapped with the WSGIScriptAlias directive.

Except for file system access permissions, being setup in a Directory block in the Apache configuration file, there was never a specific intention in the way WSGIScriptAlias worked in mod_wsgi for a .htaccess file within a directory referred to by the WSGIScriptAlias directive to be consulted. It looks like that is actually possible, at least with Apache 2.X, not sure about Apache 1.3 although possibly it worked there as well.

So it looks like the OpenShift folks have stumbled across something which is possible that isn't documented for mod_wsgi and which I as the person who wrote mod_wsgi didn't even expect to necessarily work. I am going to have to think this one through now, as there may be things one can do in the .htaccess file which can screw with how mod_wsgi works. It may also open up some strange possibilities for what users with no access to the main Apache configuration can do as well, possibly good, but also maybe bad.

Reiterating what I said in other comments, OpenShift has supported two different ways of setting up a WSGI application. The older way was to create a subdirectory called 'wsgi' and in that add an 'application' file which would be the WSGI script file. There could also be a 'wsgi/static' directory for static files. The newer way they document and now seem to recommend is to create a 'wsgi.py' file in the root directory of the project for the WSGI script file. The name of this can be overridden with an environment variable set with 'rhc set-env'.

I haven't checked for what they generate for the configuration for the older arrangement, but they could have setup the Apache configuration to allow Apache overrides in the 'wsgi' subdirectory, meaning that a .htaccess file can be placed there. This wouldn't be normal practice, but it seems they found it to work and would allow certain types of overrides.

If they have done that for the 'wsgi' subdirectory, it doesn't seem though they did the same thing for the root directory when they switched to preferring a 'wsgi.py' in the top directory.

Either way, using mod_wsgi-express as I mention will give you back a much higher level of control over how Apache and mod_wsgi is setup. The pre canned configuration isn't really flexible and some of the guesses made for the configuration based on gear size aren't necessarily appropriate as they don't take into consideration the requirements of the application itself, which only the user would know.

Answer 2

The .htaccess file needs to go inside of your wsgi folder within your python application.

Answer 3

As mentioned in Graham Dumpleton's answer OpenShift supports different layouts for a Python App. If you are using the wsgi.py approach, do the following to redirect all requests to https:

mkdir wsgi
mv wsgi.py wsgi/application
touch wsgi/.htaccess

Add the following content to the .htaccess file:

RewriteEngine on                                                                
RewriteCond %{HTTP:X-Forwarded-Proto} !https                                    
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R,L]