---
title: "Always Be Connecting (with HTTPS)"
description: "The post explains how to ensure users reach an HTTPS version of an application running behind Fly’s edge proxies, particularly when a custom domain and certificate are attached. Fly’s default fly.dev behavior redirects HTTP automatically, but custom certificates do not activate that upgrade because connection behavior remains under the application owner’s control. The recommended method checks the X-Forwarded-Proto header, which records whether the original client connection used http or https, and returns a 301 redirect to the same URL with an https scheme when needed. Examples implement the check in Go middleware, Express middleware for Node, and Nginx configuration; the post also notes that non-Fly deployments can inspect the request and URL scheme instead, while Fly was considering future automation."
---

# Always Be Connecting (with HTTPS)

[Fly.io](https://yomu.fyi/company/fly-io) · Sep 11, 2020

**Type:** Tutorial

## Summary

The post explains how to ensure users reach an HTTPS version of an application running behind Fly’s edge proxies, particularly when a custom domain and certificate are attached. Fly’s default fly.dev behavior redirects HTTP automatically, but custom certificates do not activate that upgrade because connection behavior remains under the application owner’s control. The recommended method checks the X-Forwarded-Proto header, which records whether the original client connection used http or https, and returns a 301 redirect to the same URL with an https scheme when needed. Examples implement the check in Go middleware, Express middleware for Node, and Nginx configuration; the post also notes that non-Fly deployments can inspect the request and URL scheme instead, while Fly was considering future automation.

## Context

Fly automatically redirects HTTP connections for fly.dev applications, but applications using a custom domain and certificate do not receive automatic HTTPS upgrading. The post presents this as a concern because search engines may penalize non-HTTPS sites and users increasingly use tools that prefer secure browsing.

## Approach / What changed

Inspect the X-Forwarded-Proto header added by Fly’s proxy. When it equals http, return a permanent 301 redirect to the same host and request URI using https; otherwise pass the request to the application. The post shows this pattern in Go, Express middleware for Node, and Nginx.

## Takeaways

- Fly’s AnyCast IP addresses route connections to the nearest network edge, where proxies manage the incoming http or tls connection before routing it to the application’s internal port.
- X-Forwarded-Proto records whether the original client connection used http or https, allowing an application to distinguish connections after proxy routing.
- The HTTPS upgrade pattern is demonstrated with Go middleware, Express middleware, and an Nginx rule; non-Fly deployments need to inspect the request and URL scheme instead.

**Tags:** [Fly](https://yomu.fyi/topic/fly), [Go](https://yomu.fyi/topic/go), [JavaScript](https://yomu.fyi/topic/javascript), [nginx](https://yomu.fyi/topic/nginx)

- Source: [Fly.io](https://fly.io/blog/always-be-connecting-with-https)
- Source URL: https://fly.io/blog/always-be-connecting-with-https
- Ingested by Yomu: 2026-09-02T11:58:42.316Z

[Read original post](https://fly.io/blog/always-be-connecting-with-https)