Description

To maintain the highest level of security, all connections to an application should be secure by default.

Rationale

Insecure HTTP connections may be subject to eavesdropping, which can expose sensitive data.

All connections to App Engine will automatically be redirected to the HTTPS endpoint, ensuring that all connections are secured by TLS.

Verify that the app.yaml file controlling the application contains a line that enforces secure connections. For example:

handlers: 
- url: /.* 
secure: always 
redirect_http_response_code: 301 
script: auto

By default, both HTTP and HTTPS are supported.