Force SSL on non API routes

requirements.txt

@@ -35,6 +35,7 @@ Flask-WTF==0.12
 Flask-RESTful==0.3.5
 Flask-Testing==0.5.0
 Flask-RQ==0.2
+Flask-SSLify==0.1.5
 
 # Flask DB Extensions
 Flask-SQLAlchemy==2.1

server/__init__.py

@@ -5,7 +5,7 @@
 from flask import Flask, render_template, g, request
 from flask import Markup
 from flask_rq import RQ
-from flask_wtf.csrf import CsrfProtect
+from flask_sslify import SSLify
 from webassets.loaders import PythonLoader as PythonAssetsLoader
 from werkzeug.contrib.fixers import ProxyFix
 
@@ -65,6 +65,9 @@ def internal_server_error(error):
         app.logger.addHandler(logging.StreamHandler())
         app.logger.setLevel(logging.INFO)
 
+        # SSL Force
+        sslify = SSLify(app, age=300, skips=['api'])
+
     @app.errorhandler(404)
     def not_found_error(error):
         if request.path.startswith("/api"):
@@ -86,7 +89,6 @@ def not_found_error(error):
     # initialize SQLAlchemy
     db.init_app(app)
 
-
     # Flask-Login manager
     login_manager.init_app(app)
 

server/extensions.py

@@ -3,7 +3,6 @@
 from flask_debugtoolbar import DebugToolbarExtension
 from flask_assets import Environment
 from flask_oauthlib.provider import OAuth2Provider
-
 from raven.contrib.flask import Sentry
 
 # Setup flask cache