#1474 livemode-requests-must-always-be-redirected-via-https

subscribie/blueprints/admin/__init__.py

@@ -1391,18 +1391,21 @@ def _generate_account_link(account_id):
     """
     From the Stripe Docs:
     A user that is redirected to your return_url might not have completed the
-    onboarding process. Use the /v1/accounts endpoint to retrieve the user’s
+    onboarding process. Use the /v1/accounts endpoint to retrieve the user's
     account and check for charges_enabled. If the account is not fully onboarded,
     provide UI prompts to allow the user to continue onboarding later. The user
     can complete their account activation through a new account link (generated
     by your integration). You can check the state of the details_submitted
-    parameter on their account to see if they’ve completed the onboarding process.
+    parameter on their account to see if they've completed the onboarding process.
     """
+    # Stripe requires HTTPS URLs when in live mode
+    url_scheme = 'https' if stripe_livemode() else None
+
     account_link = stripe.AccountLink.create(
         type="account_onboarding",
         account=account_id,
-        refresh_url=url_for("admin.stripe_connect", refresh="refresh", _external=True),
-        return_url=url_for("admin.stripe_connect", success="success", _external=True),
+        refresh_url=url_for("admin.stripe_connect", refresh="refresh", _external=True, _scheme=url_scheme),
+        return_url=url_for("admin.stripe_connect", success="success", _external=True, _scheme=url_scheme),
     )
     return account_link.url
 

subscribie/blueprints/checkout/__init__.py

@@ -458,7 +458,11 @@ def stripe_create_checkout_session():
     person = Person.query.get(session["person_id"])
     charge["currency"] = currency_code
     payment_method_types = ["card"]
-    cancel_url = url_for("checkout.order_summary", _external=True)
+
+    # Stripe requires HTTPS URLs when in live mode
+    url_scheme = 'https' if get_stripe_livemode() else None
+
+    cancel_url = url_for("checkout.order_summary", _external=True, _scheme=url_scheme)
     mode = "payment"
     payment_intent_data = {}
     # Build line_items array depending on plan requirements
@@ -488,7 +492,7 @@ def stripe_create_checkout_session():
         charge["sell_price"] = plan.getSellPrice(currency_code)
         charge["interval_amount"] = plan.getIntervalAmount(currency_code)
         success_url = url_for(
-            "checkout.instant_payment_complete", _external=True, plan=plan.uuid
+            "checkout.instant_payment_complete", _external=True, plan=plan.uuid, _scheme=url_scheme
         )
 
         if plan.requirements.subscription:
@@ -564,7 +568,7 @@ def stripe_create_checkout_session():
             )
 
     elif is_donation is True:
-        success_url = url_for("checkout.instant_payment_complete", _external=True)
+        success_url = url_for("checkout.instant_payment_complete", _external=True, _scheme=url_scheme)
         donation_amount = int(session["donation_amount"] * 100)
         line_items.append(
             {

subscribie/blueprints/subscriber/__init__.py

@@ -39,6 +39,7 @@
     get_stripe_connect_account_id,
     get_stripe_publishable_key,
     get_stripe_invoices,
+    get_stripe_livemode,
 )
 from subscribie.email import EmailMessageQueue
 from jinja2 import Template
@@ -264,6 +265,9 @@ def account():
                 stripe_customer_id, stripe_account=stripe_connect_account_id
             )
 
+            # Stripe requires HTTPS URLs when in live mode
+            url_scheme = 'https' if get_stripe_livemode() else None
+
             stripe_session = stripe.checkout.Session.create(
                 stripe_account=stripe_connect_account_id,
                 payment_method_types=["card"],
@@ -272,9 +276,9 @@ def account():
                 setup_intent_data={
                     "metadata": {"subscription_id": stripe_subscription.id}
                 },
-                success_url=url_for("subscriber.account", _external=True)
+                success_url=url_for("subscriber.account", _external=True, _scheme=url_scheme)
                 + "?stripe_session_id={CHECKOUT_SESSION_ID}",
-                cancel_url=url_for("subscriber.account", _external=True),
+                cancel_url=url_for("subscriber.account", _external=True, _scheme=url_scheme),
             )
             if request.args.get("stripe_session_id"):
                 # Process stripe update payment request