To enforce Google App Engine to serve using HTTPS only, use secure: always
in app.yaml
.
...
handlers:
- url: /static
static_dir: static
secure: always
- url: /favicon.ico
static_files: static/favicon.ico
upload: static/favicon.ico
secure: always
- url: /.*
script: app.app
secure: always
...
Note: Google App Engine has managed ssl since Sep 2017.