has anyone got experience using heroku? i deployed my app there yesterday, everything worked.. now i...

# server

[Nikky]

has anyone got experience using heroku?
i deployed my app there yesterday, everything worked.. now i am opening it again and my broswer fetch requests fail

Access to fetch at '<https://pentagame.herokuapp.com/api/status>' from origin '<http://pentagame.herokuapp.com>' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

as if all the cors settings i set in Ktor had no effect anymore

[Marc Knaup]

use https

https://pentagame.herokuapp.com

[Nikky]

well i do

[Nikky]

i am not sure how i do not use https

[Marc Knaup]

Your error message states that you were on
http://pentagame.herokuapp.com
instead of
https://pentagame.herokuapp.com

🙂

[Nikky]

the error happens when i go to multiplayer and the app sends a request to /api/status

[Nikky]

then i guess thats some redirect issue

[Marc Knaup]

maybe

[Marc Knaup]

It’s a good idea to make sure that your server always denies unencrypted connections

That’s more secure and makes it obviousw when such an incorrect redirect happens accidentally.

[Marc Knaup]

See https://github.com/fluidsonic/fluid-server/blob/master/sources/utility/EncryptionEnforcementFeature.kt for how to enforce HTTPS.

See lines 90 and 91 on how to use it (both features must be used):
https://github.com/fluidsonic/fluid-server/blob/6bddfc075ca15e3f7707a07926418f6ff4cee1f0/sources/Baku.kt#L90

[Nikky]

well at least a HttpRedirect Feature does not work

[Marc Knaup]

It also depends on the XForwardedHeaderSupport feature being installed.

[Marc Knaup]

Due to Heroku’s SSL termination Ktor only sees a normal non-HTTPS connection. Using the XForwardedHeaderSupport Ktor will analyze the request headers and see that Heroku did that and properly use HTTPS in situations like redirects.

[Nikky]

do the features have to be installed in order ?

[Nikky]

yes it has to be.. this works now, i stole your HttpsEnforcer for now

[Marc Knaup]

do the features have to be installed in order ?

yes