Caravel redirects HTTPS-terminated load balancer traffic to HTTP

[bobziuchkovski]

We're trying to run caravel 0.10.0 behind a load balancer on Amazon and terminate HTTPS/SSL traffic on the load balancer. We've noticed that we can access https://<caravel-behind-lb>/login, but when we supply user credentials, caravel redirects back to the plaintext http://<caravel-behind-lb>/login location. This is a bummer, and has been flagged as part of a third-party security audit.

Is there a configuration option we're missing to tell caravel to use https urls, or to tell it to respect X-Forwarded-Proto headers?

[mistercrunch]

Seems like there's a solution here:
http://stackoverflow.com/questions/23347387/x-forwarded-proto-and-flask

I'd approve a PR that would add ENABLE_PROXY_FIX = False to caravel/config.py and:

if config.get('ENABLE_PROXY_FIX'):
    app.wsgi_app = ProxyFix(app.wsgi_app)

to caravel/__init__.py

[bobziuchkovski]

@mistercrunch Thanks for pointing that out. I've submitted a PR (#1150) that adds the ProxyFix support. We just deployed 0.10.0 with that commit cherry-picked and confirmed we're no longer being redirected from https to http.