request.requires_https() while using taskqueue.add() in GAE possible?

[Robert Porter]

If I use Google's taskqueue.add(), it keeps giving me a 303 error over and over in the logs because it tries to use the HTTP version of the page the POST is sent to, but I have request.requires_https() in my db.py.  I can't find a way for taskqueue to attempt an HTTPS connection.

Removing request.requires_https() solves the issue, but isn't quite ideal.

Anyone know a way around this?

[Anthony]

You can conditionally set request.requires_https() depending on whether the request comes from a GAE Task Queue. Apparently, Task Queue requests will include HTTP headers as noted here: https://stackoverflow.com/a/14838696. So, you can do something like:

if 'HTTP_X_APPENGINE_TASKNAME' not in request.env:
    request.requires_https()

Note, any client can send those headers, so if you are worried about someone spoofing such a request and then getting an HTTP connection, you might instead be able to detect Task Queue requests by IP address. According to the docs, Task Queue requests come from IP address 0.1.0.2. So, the code would be:

if request.env.remote_addr != '0.1.0.2':
    request.requires_https()

Anthony