GithubHelp home page GithubHelp logo

express-enforces-ssl's Introduction

express-enforces-ssl

npm

This simple module enforces HTTPS connections on any incoming requests. In case of a non-encrypted HTTP request, express-enforces-ssl automatically redirects to an HTTPS address using a 301 permanent redirect.

express-enforces-ssl also works behind reverse proxies (load balancers) as they are for example used by Heroku and nodejitsu. In such cases, however, the trustProxy parameter has to be set (see below)

Usage

First, install the module:

$ npm install express-enforces-ssl --save

Afterwards, require the module and use the HTTPS() method:

var express = require('express');
var http = require('http');
var express_enforces_ssl = require('express-enforces-ssl');

var app = express();

app.enable('trust proxy');

app.use(express_enforces_ssl());

/*
    Routes Here
*/

http.createServer(app).listen(app.get('port'), function() {
	console.log('Express server listening on port ' + app.get('port'));
});

LICENCE

MIT

express-enforces-ssl's People

Contributors

evanhahn avatar hengkiardo avatar psirenny avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar

express-enforces-ssl's Issues

403 when authentication headers are sent

The redirect is convenient, but if you're using authentication headers, the fact that the web server processes the request can lead to insecure behavior: developer sends secret token over HTTP, and if the client library automatically follows redirects, everything works, but the token was exposed.

I suggest you respond with 403 when using authentication, similar to what you do with non-GETs.

Um Please Help, What Is This? Thanks Although

Hi, I have an app that only works when I go to it via https. If you visit "http://gameof.ninja" it just hangs and doesn't respond, but if you visit "https://gameof.ninja" it works.

I thought that this project would help me so that when I go to "http://gameof.ninja" it forwards to https and works, but that doesn't seem to be the case since I installed and followed instructions but still hangs when I visit "http://gameof.ninja". Am I totally misunderstanding what this project is supposed to do? Thanks.

trustProxy argument seems unnecessary

Hello!

I jus saw your module appear on echo js. I just wanted to let you know that it seems that the trustProxy argument to your module seems unnecessary. This is because req.secure in express already checks the proxy header is the user setup their "trust proxy" option in their express app.

The reason I bring this up is because X-Forwarded-Proto may actually be a comma-separated list, which this module does not handle. In addition, "trust proxy" in express allows users to choose the source IPs they can actually trust, while your option will blindly trust the header from all requests, which may be spoofed.

Happy coding!

Deprecated message using express 4.16.3

I receive this message when trying to use this package with express:

express deprecated res.send(status, body): Use res.status(status).send(body) instead node_modules/express-enforces-ssl/index.js:21:7

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.