👍 for the idea, 👎 for the implementation.

I currently do the following in my routes factory to achieve this behavior:

if ($request->isSecured()) {
    Route::$defaultFlags |= Route::SECURED;
}

I think this implementation is worse, it has unwanted behavior - it will set to every route this property. In my implementation you can select which routes have this property.

I like the idea too. I'm using it often in private applications. @Majkl578 solution is often used as:

$optionallySecured = $request->isSecured() ? Route::SECURED : 0;

new Route(..., ..., Route::FLAG | $optionallySecured);

I think this implementation is worse, it has unwanted behavior - it will set to every route this property.

You can't generalize it like this. It may or may not be an intended behavior. Since I make apps using Facebook, it's intended. Otherwise I use more-or-less what @milo mentioned:

new Route(..., ..., Route::$defaultFlags | $optionallySecured);

You can't generalize it like this. It may or may not be an intended behavior.

It may be inteded behavior (depends on project), but as default I would like to keep existing state.
In fact this behavior is BC - because if somebody will have routes in this order:

1. HTTP route index.php ("Go over https!")
2. HTTPS route index.php ("Hi man!")
   => first route will match even https version of index.php

Solution of @milo is fine, but I think is less userfriendly for beginners (why to explain bit OR to beginner during routing).

@vjirovsky great idea 👍

I use same code as @Majkl578

if ($request->isSecured()) {
    Route::$defaultFlags |= Route::SECURED;
}

This issue is mostly problematic because developers realize it quite late - after deploying application into a production. Till then, they expect routing will work as same as it ignores domain names. The route doesn't force any protocol, so this behavior should be the default one.

@hrach I force it at Nginx mainly.

@f3l1x please follow the text, so do I, so does everyone.

The route doesn't force any protocol, so this behavior should be the default one.

👍 Can anyone think of some negative impact?

Current default behavior (correct me please if I'm wrong) is to accept (match) both HTTP and HTTPS requests but generate always HTTP unless SECURED flag is set.

Behavior matrix to summarize

I'm not sure whether running both HTTP & HTTPS is still an issue nowadays...
Web is moving towards TLS only -- we have HTTP/2 that requires TLS, we also have free certificates provided by Let's Encrypt.

Idea: What about not to update Route, but:
a) add example code to sandbox's bootstrap commented out, or
b) adjust router factory in sandbox to control this functionality

It will warn people that there is something to configure.

IMHO default behavior can be changed to copy protocol when route mask doesn't contain domain or when generated domain is the same as current domain (+subdomain).

IMHO default behavior can be changed to copy protocol

Can this be done in Nette 2.4?