1

I have a flask server and nginx handling the incoming connections. When I call a specific method of the flask api using https it works fine, the problem is when nginx redirects from http to https and the data included in the python call gets lost.

NGINX config file:

server {
    server_name myurl.com;
    listen 80;

    location / {
        return 301 https://myurl.com$request_uri;
    }
}

server {
    server_name myurl.com;
    listen 443 ssl;

    add_header Strict-Transport-Security "max-age=31536000";

    ssl_certificate /etc/letsencrypt/live/myurl.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/myurl.com/privkey.pem;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    
    ssl_prefer_server_ciphers on;

    location / {
        include uwsgi_params;
        uwsgi_pass flask_server:5555;
    }
}

Python call:

from requests import get

token = {'token': 'thetoken1234'}
data={'kms': '80000'}
response = get('http://myurl.com/evaluate_car', headers=token, data=data).json()

Calling the https version of the url works fine but in the http case the "kms" variable in the data dictionary is getting lost.

What I need to include in the NGINX config file to keep this data dictionary?

7
  • Do you really mean to use GET as method? Passing data is usually done through PUT Commented Apr 14, 2023 at 15:37
  • Is a get request with input parameters and is already working with https Commented Apr 14, 2023 at 15:41
  • point is that in a get request with form-encoded, as your get(…, data=data) causes, the data is part of the URL – and you're specifically overwriting that URL with your redirect, so this is all correct from my perspective. Easy solution: don't use GET for something which is usually done using PUT. Commented Apr 14, 2023 at 15:51
  • By the way, redirecting to HTTPS is useless in this scenario. You're not stopping your clients from sending the unencrypted data with a redirect. You simply mustn't even offer the endpoints under HTTP. Commented Apr 14, 2023 at 15:58
  • Thats right. The best option should be to delete the http option. Commented Apr 14, 2023 at 16:00

0

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.