Redirecting to other website enforces https when it should not

[antoineleclair]

We have a website (https://example.com) with some URLs that moved to other sites, so we return 301s to those new URLs.

For example: https://example.com/old-url-that-moved should return a 301, with a Location header of http://other-site.com/new-url

The issue is that the redirect tween changes the scheme of the other domain to https, but the other domain does not serve the pages through https. In the example above, instead of redirecting to http://other-example.com/new-url like it should, users are redirected to https://other-example.com/new-url and the page does not load.

pyramid_hsts/src/pyramid_hsts/__init__.py

Lines 243 to 245 in 11725d1

	if 300 <= response.status_code < 400:
	if response.location is not None:
	response.location = secure_url(response.location)

[antoineleclair]

Also, if this issue is fixed, the fix should probably respect the config to include or not the subdomains.