Force TLS connections?

[btracey]

Netlify has a "Force TLS connections" , "Forcing TLS will redirect all traffic to HTTPS and set Strict Transport Security Headers for 1 year."

Is this something we want? We somewhat force this anyway because the hugo generation (at least at the moment) hard paths https links.

[kortschak]

What happens if we don't? What happens after a year?

[btracey]

If we don't we get this somewhat weird bouncing of people going to http but ending up in https anyway. I think after a year we have to enable it again. The warning that comes with it is

"Warning! Once you force TLS connections, people who visit your site won’t be able to access the HTTP version if you change this setting later."

I'm guessing that means the process is somewhat irreversible for a year.

[kortschak]

OK. I'm happy to force TLS.

[han-so1omon]

@btracey I think force TLS is the way to go. Netlify plans to support exclusively TLS traffic if they haven't done so already. See this issue from the netlify team: netlify/cli#158

[kortschak]

This is done with the new website build.