Plug.SSL

A plug to force SSL connections.

If the scheme of a request is https, it’ll add a strict-transport-security header to enable HTTP Strict Transport Security.

Otherwise, the request will be redirected to a corresponding location with the https scheme by setting the location header of the reponse. The status code will be 301 if the method of conn is GET or HEAD, or 307 in other situations.

x-forwaded-proto

If your Plug application is behind a proxy that handles HTTPS, you will need to tell Plug to parse the proper protocol from the “x-forwarded-proto” header. This can be done using the :rewrite_on option:

use Plug.SSL, rewrite_on: [:x_forwarded_proto]

The command above will effectively change the value of conn.scheme by the one sent in “x-forwarded-proto”.

Since rewriting the scheme based on “x-forwarded-proto” can open up security vulnerabilities, only provide the option above if:

* Your app is behind a proxy
* Your proxy strips "x-forwarded-proto" headers from all incoming requests
* Your proxy sets the "x-forwarded-proto" and sends it to Plug

Options

• :rewrite_on - rewrites the scheme to https based on the given headers
• :hsts - a boolean on enabling HSTS or not, defaults to true.
• :expires - seconds to expires for HSTS, defaults to 31536000 (a year).
• :subdomains - a boolean on including subdomains or not in HSTS, defaults to false.
• :host - a new host to redirect to if the request’s scheme is http.