This lesson's interactive features are locked, please to keep using them

HTTPS

HTTPS carries ordinary HTTP messages through TLS. Paths, headers, and body content are protected between the TLS endpoints. Some connection metadata, like the destination IP and sometimes the hostname, may remain visible.

TLS at the Proxy

It's super common for production webapps to sit behind a reverse proxy that terminates TLS before traffic reaches the app server. The proxy owns the public HTTPS policy and forwards requests to the app over a trusted private network.

The unencrypted hop is safe only when the proxy is the app's sole public entry point and the private network between them is trusted.

Caddy can obtain and renew certificates, redirect HTTP to HTTPS, and forward requests with a small configuration:

tickets.example.com {
  header Strict-Transport-Security "max-age=31536000; includeSubDomains"
  reverse_proxy 127.0.0.1:4000
}

The bare domain activates Caddy's automatic HTTPS. Caddy also sets X-Forwarded-For, X-Forwarded-Proto, and X-Forwarded-Host for the upstream and ignores spoofed incoming values for those headers by default.

Go doesn't have a global trust proxy switch. Bearly Secure records the exact number of trusted proxy hops in its configuration so HTTP features can consistently select forwarded values. A value of 1 is appropriate only when every request reaches the app through exactly one trusted proxy. Direct local development should keep the value at 0.

HSTS

HTTP Strict Transport Security (HSTS) tells browsers, "Hey, this host should only be accessed over HTTPS." It's sent in the Strict-Transport-Security response header and affects future requests only after the browser receives it over HTTPS.

Add includeSubDomains only when every subdomain supports HTTPS. Otherwise, HSTS can make HTTP-only subdomains inaccessible.

Assignment

Bearly Secure has no production TLS boundary. Put Caddy in front of the app and record the trusted proxy topology.

Create a file named Caddyfile in the project root.
Configure a reverse proxy for bearly-secure.example to 127.0.0.1:3030. Use the bare domain so Caddy manages certificates and redirects HTTP to HTTPS.

Set the following header:

Strict-Transport-Security "max-age=31536000; includeSubDomains"

Add the following to .env.example:

# Set to 1 only when every request passes through exactly one trusted proxy
TRUST_PROXY_HOPS=0

In internal/config/config.go, add TrustedProxyHops to Config and parse TRUST_PROXY_HOPS as a non-negative integer with a default of 0.
Add the hop count to httpserver.Options and pass it from cmd/server/main.go.
If Caddy is installed, validate the configuration:
```
caddy validate --config Caddyfile
```

With Bearly Secure still running, run and submit the CLI tests from the project root.