Why is SSL disabled by default in production?

[oerd]

Hi,

I noticed that SSL is by default disabled in the ProductionConfig class in config.py. The line of code is:

SSL_DISABLE = (os.environ.get('SSL_DISABLE', 'True') == 'True')

In case SSL_DISABLE is not set, the default value will be True which from my point of viewing means SSL (or TLS for that matter) will be disabled.

[abhisuri97]

I believe the original reasoning for keeping it disabled by default was that not all production environments had ssl certs installed. By setting SSL_DISABLE to false, you were consciously saying “yes, i have an ssl cert installed, please redirect all traffic to ssl”. However, in hindsight, this is very confusing, so I’d welcome a PR to change that.