Remove secure flag entirely

CHANGELOG.md

@@ -14,7 +14,7 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 ### Removed
 - API versioning feature - @calebmer
 - `--db-x` command line arguments - @calebmer
-- Secure flag responds with 403 instead of redirect - @calebmer
+- Remove secure flag - @calebmer
 
 ### Fixed
 - Tolerate a missing role in user creation - @calebmer

src/PostgREST/Config.hs

@@ -38,7 +38,6 @@ data AppConfig = AppConfig {
   , configPort      :: Int
   , configAnonRole  :: String
   , configSchema    :: String
-  , configSecure    :: Bool
   , configJwtSecret :: String
   , configPool      :: Int
   }
@@ -49,8 +48,7 @@ argParser = AppConfig
 
   <*> option auto  (long "port"       <> short 'p' <> help "port number on which to run HTTP server" <> metavar "PORT" <> value 3000 <> showDefault)
   <*> strOption    (long "anonymous"  <> short 'a' <> help "postgres role to use for non-authenticated requests" <> metavar "ROLE")
-  <*> strOption    (long "schema"     <> short 'S' <> help "schema to use for API routes" <> metavar "NAME" <> value "1" <> showDefault)
-  <*> switch       (long "secure"     <> short 's' <> help "redirect all requests to HTTPS")
+  <*> strOption    (long "schema"     <> short 's' <> help "schema to use for API routes" <> metavar "NAME" <> value "1" <> showDefault)
   <*> strOption    (long "jwt-secret" <> short 'j' <> help "secret used to encrypt and decrypt JWT tokens" <> metavar "SECRET" <> value "secret" <> showDefault)
   <*> option auto  (long "pool"       <> short 'o' <> help "max connections in database pool" <> metavar "COUNT" <> value 10 <> showDefault)
 

src/PostgREST/Main.hs

@@ -46,8 +46,6 @@ main = do
   conf <- readOptions
   let port = configPort conf
 
-  unless (configSecure conf) $
-    putStrLn "WARNING, running in insecure mode, auth will be in plaintext"
   unless ("secret" /= configJwtSecret conf) $
     putStrLn "WARNING, running in insecure mode, JWT secret is the default value"
   Prelude.putStrLn $ "Listening on port " ++
@@ -57,7 +55,7 @@ main = do
       appSettings = setPort port
                   . setServerName (cs $ "postgrest/" <> prettyVersion)
                   $ defaultSettings
-      middle = logStdout . defaultMiddle (configSecure conf)
+      middle = logStdout . defaultMiddle
 
   poolSettings <- maybe (fail "Improper session settings") return $
     H.poolSettings (fromIntegral $ configPool conf) 30

src/PostgREST/MainTest.hs

@@ -54,8 +54,6 @@ main = do
   conf <- readOptions
   let port = configPort conf
 
-  unless (configSecure conf) $
-    putStrLn "WARNING, running in insecure mode, auth will be in plaintext"
   unless ("secret" /= configJwtSecret conf) $
     putStrLn "WARNING, running in insecure mode, JWT secret is the default value"
   Prelude.putStrLn $ "Listening on port " ++
@@ -65,7 +63,7 @@ main = do
       appSettings = setPort port
                   . setServerName (cs $ "postgrest/" <> prettyVersion)
                   $ defaultSettings
-      middle = logStdout . defaultMiddle (configSecure conf)
+      middle = logStdout . defaultMiddle
 
   poolSettings <- maybe (fail "Improper session settings") return $
     H.poolSettings (fromIntegral $ configPool conf) 30

src/PostgREST/Middleware.hs

@@ -10,10 +10,9 @@ import qualified Hasql                         as H
 import qualified Hasql.Postgres                as P
 
 import           Network.HTTP.Types.Header     (hAccept, hAuthorization)
-import           Network.HTTP.Types.Status     (status403, status415)
-import           Network.Wai                   (Application, Request (..),
-                                                Response, isSecure, requestHeaders,
-                                                responseLBS)
+import           Network.HTTP.Types.Status     (status415)
+import           Network.Wai                   (Application, Request (..), Response,
+                                                requestHeaders, responseLBS)
 import           Network.Wai.Middleware.Cors   (cors)
 import           Network.Wai.Middleware.Gzip   (def, gzip)
 import           Network.Wai.Middleware.Static (only, staticPolicy)
@@ -50,15 +49,6 @@ runWithClaims conf app req = do
             else setRole anon : jwtEnv
    jwtEnv = claimsToSQL claims
 
-checkInsecure :: Application -> Application
-checkInsecure app req respond =
-  if not (isSecure req || isHerokuSecure)
-    then respond $ responseLBS status403 [] "SSL is required"
-    else app req respond
-  where
-    hdrs = requestHeaders req
-    isHerokuSecure = lookup "x-forwarded-proto" hdrs == Just "https"
-
 unsupportedAccept :: Application -> Application
 unsupportedAccept app req respond = do
   let
@@ -67,8 +57,9 @@ unsupportedAccept app req respond = do
   then respond $ responseLBS status415 [] "Unsupported Accept header, try: application/json"
   else app req respond
 
-defaultMiddle :: Bool -> Application -> Application
-defaultMiddle secure = (if secure then checkInsecure else id)
-  . gzip def . cors corsPolicy
+defaultMiddle :: Application -> Application
+defaultMiddle =
+    gzip def
+  . cors corsPolicy
   . staticPolicy (only [("favicon.ico", "static/favicon.ico")])
   . unsupportedAccept

test/SpecHelper.hs

@@ -41,7 +41,7 @@ isLeft (Left _ ) = True
 isLeft _ = False
 
 cfg :: AppConfig
-cfg = AppConfig dbString 3000 "postgrest_anonymous" "test" False "safe" 10
+cfg = AppConfig dbString 3000 "postgrest_anonymous" "test" "safe" 10
 
 testPoolOpts :: PoolSettings
 testPoolOpts = fromMaybe (error "bad settings") $ H.poolSettings 1 30
@@ -78,7 +78,7 @@ withApp perform = do
       $ runWithClaims cfg (app dbstructure cfg body) req
     either (resp . errResponse) resp result
 
-  where middle = defaultMiddle False
+  where middle = defaultMiddle
 
 
 resetDb :: IO ()