调用 App Engine 柔性环境 API 时如何停止混合内容浏览器错误？

Question

我在浏览器中收到此错误：

Mixed Content: The page at 'https://{my-site}' was loaded over HTTPS, but 
requested an insecure XMLHttpRequest endpoint 'http://{my-api}'. This request 
has been blocked; the content must be served over HTTPS.

我知道我需要以某种方式允许 https。该应用程序使用 Gunicorn 运行自定义 Google App Engine Flexible Environment 上的应用程序。它还使用烧瓶。这是我的 app.yaml：

runtime: custom
env: flex
service: flex-module
entrypoint: gunicorn -b :$PORT main:app

是否可以更改可扩展服务代理中的某些设置以允许 App Engine 中的 https？或者我需要获得 ssl 证书和密钥并将以下内容添加到我的 app.yaml:

gunicorn -w3 --certfile=server.crt --keyfile=server.key test:app

此外，我不确定是否需要将其添加到 gunicorn.conf.py 中，如 this documentation:

forwarded_allow_ips = '*'
secure_scheme_headers = {'X-APPENGINE-HTTPS': 'on'}

谢谢

Answer 1

如 documentation 中所述，Google 不会为托管在 appspot.com:

的双通配符域颁发 SSL 证书

Note: Google recommends using the HTTPS protocol to send requests to your app. Google does not issue SSL certificates for double-wildcard domains that are hosted at appspot.com. Therefore, HTTPS requests must use the string "-dot-" as the URL notation, instead of "." for separating subdomains. You can use the simple "." URL notation with your own custom domains and other HTTP addresses. For more information, see the HTTP and HTTPS examples in the following sections.

因此，为了允许 API 通过 https 请求并避免混合内容浏览器错误，而不是 http://version-one.my-app.appspot.com 我需要将请求发送到：https://version-one-dot-my-app.appspot.com

Answer 2

要进行 HTTPS 调用，请通过将以下配置添加到 app.yaml 文件来为您的应用启用 ssl 库：

libraries:

名称：ssl 版本：最新

https://google-auth.readthedocs.io/en/latest/user-guide.html

调用 App Engine 柔性环境 API 时如何停止混合内容浏览器错误？

How to stop mixed Content browser Error when calling App Engine Flexible Environment API?

google-app-engine

gunicorn

app-engine-flexible