Control: 4.10 Ensure That App Engine Applications Enforce HTTPS Connections

Description

In order to maintain the highest level of security all connections to an application should be secure by default.

Insecure HTTP connections maybe subject to eavesdropping which can expose sensitive data.

Remediation

Add a line to the app.yaml file controlling the application which enforces secure connections. For example

handlers:
- url: /.*
  **secure: always**
  redirect_http_response_code: 301
  script: auto

https://cloud.google.com/appengine/docs/standard/python3/config/appref

Default Value

By default both HTTP and HTTP are supported.