force-ssl-heroku
v1.0.2
Published
An express middleware that redirects unencrypted HTTP requests to HTTPS
Downloads
6,627
Readme
force-ssl-heroku
An express middleware that redirects unencrypted HTTP requests to HTTPS on Heroku instances.
Heroku does SSL termination at its load balancer. However, the internal nodeJS app can tell if the original request was made with HTTP by inspecting headers inserted by Heroku. We can use this to redirect to the HTTPS Heroku url.
Installation
npm install force-ssl-heroku --save
Usage
It's designed for use with express:
var express = require('express');
var forceSsl = require('force-ssl-heroku');
var app = express();
app.use(forceSsl);
// Example:
app.get('/ping', pingHandler); // I'll now redirect to HTTPS.
// ... configure the rest of your routes.
app.listen(3000, 'localhost');
Caveat
It works because Heroku exposes your app through a reverse proxy which is used for load-balancing and other things. This reverse proxy does SSL termination and forwards to your app which should only accept connections from localhost. The middleware detects this situation by inspecting headers inserted by Heroku's reverse proxy; since headers can be spoofed, you should not use this middleware anywhere that's not behind such a proxy!