==== SSLHandler

The javadoc:handler.SSLHandler[] forces clients to use HTTPS by automatically redirecting all non-secure (HTTP) requests to their secure (HTTPS) version.

Before using this handler, ensure you have followed the instructions in the <<tooling-and-operations-server-https-support, HTTPS Support>> section to enable SSL on your server.

.Usage
[source, java, role = "primary"]
----
import io.jooby.handler.SSLHandler;

{
  before(new SSLHandler()); // <1>
  
  get("/", ctx -> "You are on: " + ctx.getScheme());
}
----

.Kotlin
[source, kotlin, role = "secondary"]
----
import io.jooby.handler.SSLHandler

{
  before(SSLHandler())      // <1>
  
  get("/") { "You are on: ${ctx.scheme}" }
}
----

<1> Install the `SSLHandler` as a `before` filter.

The handler reconstructs the HTTPS URL using the `Host` header. If your application is running behind a load balancer or reverse proxy, you must enable the <<core-router-options-routing, trust proxy>> option to ensure the handler correctly identifies the client's original protocol and host.

===== Customizing the Host

By default, the handler redirects to the host provided in the request. You can explicitly specify a destination host if needed:

.Explicit Host Redirect
[source, java, role = "primary"]
----
{
  // Redirects all traffic to https://myhost.org
  before(new SSLHandler("myhost.org"));
}
----

.Kotlin
[source, kotlin, role = "secondary"]
----
{
  // Redirects all traffic to https://myhost.org
  before(SSLHandler("myhost.org"))
}
----

[TIP]
====
For production environments behind a reverse proxy (like Nginx, HAProxy, or an AWS ALB) that terminates SSL, the `SSLHandler` relies on the `X-Forwarded-Proto` header. Make sure your proxy is configured to send it and that you have enabled `setTrustProxy(true)` in your Jooby configuration.
====
