Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My flask-webapp was utilizing BrowserId. When I tried to extend my app further by redirecting all incoming requests to HTTPS. The HTTPS redirect worked fine but now the login feature results in a:

login failure: error

What is causing this problem? What might I do to fix it? In case it matters here is my webapp.. I'm deploying on heroku using Gunicorn as the server. Here are the heroku logs for a failed login

share|improve this question
Rather than redirecting from HTTP to HTTPS, it is better to ensure that the original request is placed over HTTPS in the first place. Have you tried that? – D.W. Jan 9 '13 at 8:04
@D.W I believe thats what the extension i linked is achieving. I believe it doesn't allow http connections with say the heroku routing layer. – Drewverlee Jan 9 '13 at 16:00
DrewV, I must not have been clear enough. You'll know better than I how flask-sslify works. But... your question says you are "redirecting all incoming requests to HTTPS". And, the code of flask-sslify suggests that it has the ability to accept a http request and redirect it to a https request (see redirect_to_ssl(), line 52 of I am saying, don't do that: instead of having the client make the request over HTTP and then the server issuing a redirect to HTTPS, have the client make the request over HTTPS in the first place (so that no redirect needs to occur). – D.W. Jan 9 '13 at 17:28
@D.W Your probable being very clear to someone isn't very new to web development like me. I'm unsure how to force the client to make the request over HTTPS in the first place. I thought that was the purpose of the restricting /redirecting that happens in said extension. – Drewverlee Jan 9 '13 at 18:03
DrewV, my comments are probably vague because I don't know how your client works. How does your client work? You may need to modify the client, e.g., modify what URL it POSTS to; or you may need to change what URL you give to the client (to change what URL it's going to POST to). You should be able to check whether you were successful using Wireshark or Firebug or similar to see what requests the client is making; if it's making a HTTPS request directly, that's good, if it is making a HTTP request and receiving a redirect in response, that might be related to the problem. – D.W. Jan 9 '13 at 20:35

I'm not familiar with Flask, but I suspect that this might be due to a problem with redirecting a POST request. In particular the POST request that the front-end sends to the backend in order to verify the assertion.

One thing you could try (to test the above theory) is to have your application not listen on port 80 and only on 443. That way there won't be a mix of HTTP and HTTPS and flask-sslify will not have to redirect anything.

share|improve this answer
I'm deploying on heroku so and it seems they heroku sets the port on "the backend". Is there another way to test this? Thanks. – Drewverlee Jan 9 '13 at 1:49

One thing you can try is to try modifying the client, to POST directly to HTTPS.

It sounds like what might be happening right now is that the client is POSTing to a HTTP URL; then flask-sslify receives the HTTP request, responds to the client with a redirect, and triggers the client to re-send the POST request to a HTTPS URL.

You should be able to check whether this is what is happening using, e.g., Firebug or Wireshark or any other tool that lets you view what requests the client is making.

If this is what is happening right, one thing you could try is changing the client so that it POSTs via HTTPS directly. In other words, try to change the client so that the initial POST request is submitted over HTTPS, so that it never goes over HTTP and never triggers a redirect. I would suggest trying this, to see if it makes the problem go away. If it does make the problem go away, it gives some hint about where the problem might lie (maybe the client doesn't handle redirects for POSTs in the way you'd want, or maybe there's an issue in flask-sslify; in any case, it's a giant clue that should help debug the problem).

You can verify whether you were successful in ensuring that the client submits the POST initially over HTTPS in the first place, using the same debugging tools (e.g., Firebug or Wireshark).

Generally speaking, having the client use HTTPS directly (if possible) is better than relying upon server-initiated redirects to redirect the client from HTTP to HTTPS. It'll simplify things, and is also more secure. (If the client sends its initial request over HTTP, and you rely upon a server-initiated redirect, then you will still be vulnerable to man-in-the-middle attacks. If the client's initial request is over HTTPS, then you're not vulnerable to man-in-the-middle attacks.) It's possible that simplifying things like this might cause the bug to go away, and it shouldn't be too difficult to check whether that is indeed the case.

On the other hand, if your client is already POSTing directly to HTTPS (if your client never sends any HTTP request in the first place, and there's no server-side redirect), then I don't have the foggiest idea what's going on.

share|improve this answer
I updated the question with more information. This question will expose more of my ignorance but by client your referring to my webapp which i deployed with heroku right? – Drewverlee Jan 9 '13 at 22:16
@Drew, No. Your web app runs on the server, and handles HTTP/HTTPS requests. The client is what generates the HTTP/HTTPS requests. The client is usually the user's web browser: the user clicks on something, and the browser sends a HTTP/HTTPS request to the web server (to your web application). You could read up a little bit of background on HTTP works; you might find that helpful in understanding how web applications work. – D.W. Jan 9 '13 at 22:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.