HSTS never inserted with Connect.js middleware about helmet

[hb9cwp]

Indeed, the RFC states in section 7.2 "An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport."

However, I can not find an equivalent for req.secure in Connect in order to suggest a fix for the if statement.

[EvanHahn]

Here's how req.secure is defined in Express:

req.__defineGetter__('secure', function(){
  return 'https' == this.protocol;
});

And then req.protocol is defined like this:

req.__defineGetter__('protocol', function(){
  var trustProxy = this.app.get('trust proxy');
  if (this.connection.encrypted) return 'https';
  if (!trustProxy) return 'http';
  var proto = this.get('X-Forwarded-Proto') || 'http';
  return proto.split(/\s*,\s*/)[0];
});

So it's a little hairy, because it starts to get more complex.

Any ideas? Maybe we should detect Express and do what we currently do, and if Express isn't there, then do something else.

[EvanHahn]

Just wrote isExpress, which might help us.

[EvanHahn]

Right now, we have a boolean called isSecure, and if it's true, then it sets the header.

What if we defined it like this:

var isSecure = (req.secure) ||
  (req.connection.encrypted) ||
  (req.headers['front-end-https'] == 'on') ||
  (req.headers['x-forwarded-proto'] == 'https');

Would that be enough?

I also think we should add a force option that skips this detection.