From 1360453664a7b583dd0b9b3d3e3a6cc7831f6672 Mon Sep 17 00:00:00 2001
From: Ben Lovell <ben.j.lovell@gmail.com>
Date: Wed, 25 Mar 2026 16:27:33 +0100
Subject: [PATCH] fix: upgrade http to https in session URL for non-local hosts

When logging in with an http:// URL against a remote server, reqwest
silently downgrades POST to GET on 301/302 redirects (per RFC 7231),
causing subsequent commands like `tower teams switch` to fail with 404.
---
 crates/tower-cmd/src/session.rs | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/crates/tower-cmd/src/session.rs b/crates/tower-cmd/src/session.rs
index 8f0f8f24..4345a783 100644
--- a/crates/tower-cmd/src/session.rs
+++ b/crates/tower-cmd/src/session.rs
@@ -115,8 +115,12 @@ fn finalize_session(
 ) {
     let mut session = Session::from_api_session(&session_response.session);
 
-    // we have to copy in the tower URL so that we save it for later on!
-    session.tower_url = config.tower_url.clone();
+    let mut url = config.tower_url.clone();
+    let local = matches!(url.host_str(), Some("localhost" | "127.0.0.1" | "::1"));
+    if url.scheme() == "http" && !local {
+        let _ = url.set_scheme("https");
+    }
+    session.tower_url = url;
 
     if let Err(err) = session.save() {
         spinner.failure();