How to enforce https on client/browsers

My web application is on GCP and accepts requests on both http and https. I want to enforce https only connections without creating friction in user experience.

If I remove http then I am afraid that a user typing http://mywebapp.com will get 404. Should the right approach be to accept requests on both http and https and redirect http requests (303) so that the client send the request again using https?

• Is doing above possible?
• Wouldn't that increase my traffic cost (on gcp due to redirection/duplicate requests)
• Is there some other better way to achieve what I want?

Solution 1:

You set up both HTTP and HTTPS listeners. You configure your HTTP listener to answer the client with a 301 permanent redirect. You set up your HTTPS listener to send an HSTS header to make standards compliant clients only ever attempt HTTPS connections in the future. Each client will only attempt the HTTP listener once and then use the HTTPS one until they’ve forgotten about your service or until the HSTS lifetime runs out without being renewed.