thenativeweb / forcedomain Goto Github PK

forcedomain is a middleware for Connect and Express that redirects any request to a default domain.

License: MIT License

TypeScript 100.00%

forcedomain's Introduction

forcedomain

forcedomain is a middleware for Connect and Express that redirects any request to a default domain, e.g. to redirect to either the www or the non-www version of a domain.

Status

Category	Status
Version
Dependencies
Dev dependencies
Build
License

Installation

$ npm install forcedomain

Quick start

The first thing you need to do is to integrate forcedomain into your application. For that add a reference to the forcedomain module:

const { forceDomain } = require('forcedomain');

If you use TypeScript, use the following code instead:

import { forcedomain } from 'forcedomain';

If you now want to redirect your requests to a specific host, include the middleware and configure it accordingly:

app.use(forceDomain({
  hostname: 'www.example.com'
}));

Additionally, you can also specify a port and a target protocol:

app.use(forceDomain({
  hostname: 'www.example.com',
  port: 4000,
  protocol: 'https'
}));

By default, forcedomain redirects using permanent request. This is generally considered best practice with respect to SEO, as it tells search engines that there is a single long-term canonical address for a ressource.

If you want to use a temporary redirect instead, specify it as redirection type:

app.use(forceDomain({
  hostname: 'www.example.com',
  type: 'temporary'
}));

You can use excludeRule to disable redirect based on a regular expression:

app.use(forceDomain({
  hostname: 'www.example.com',
  excludeRule: /[a-zA-Z0-9][a-zA-Z0-9-]+\.herokuapp\.com/i
}));

You can use isEnabled to enable or disable redirection. Default value is true.

app.use(forceDomain({
  hostname: 'www.example.com',
  isEnabled: false
}));

Please note that localhost and local IPs (127.0.0.1, 192.168.x.x) are always being excluded from redirection. Hence you can continue developing locally as you are used to.

Using a reverse-proxy

If you are running your web application behind a reverse proxy such as Nginx, you have to forward the originally requested host.

server {
  // ...

  location / {
    proxy_pass http://localhost:3000;
    proxy_set_header Host $http_host;
  }
}

Running the build

To build this module use roboter.

$ npx roboter

forcedomain's People

Contributors

Stargazers

Watchers

forcedomain's Issues

ports

Do i need to add the port?

My app runs on port 8080 in development and port 80 in production.

I have a config variable I can use, but it includes http://example.com:8080 or http://example.com

Can I just use that

app.use(require('node-force-domain').redirect(cfg.site_url));

Dependencies vulnerable to Prototype Pollution

npm audit report

express <=4.17.2 || 5.0.0-alpha.1 - 5.0.0-alpha.8
Severity: high
qs vulnerable to Prototype Pollution - GHSA-hrpp-h998-j3pp
Depends on vulnerable versions of body-parser
Depends on vulnerable versions of qs
fix available via npm audit fix --force
Will install [email protected], which is a breaking change
node_modules/forcedomain/node_modules/express
forcedomain >=2.1.0
Depends on vulnerable versions of express
node_modules/forcedomain

qs 6.7.0 - 6.7.2
Severity: high
qs vulnerable to Prototype Pollution - GHSA-hrpp-h998-j3pp
fix available via npm audit fix --force
Will install [email protected], which is a breaking change
node_modules/forcedomain/node_modules/qs
body-parser 1.19.0
Depends on vulnerable versions of qs
node_modules/forcedomain/node_modules/body-parser

4 high severity vulnerabilities

Unlock lodash version

Hello,

we are using your module, it is great.
But there is some small issue about dependency.

In this package is dependency (lodash) locked to specific version. Which means that there should not be used any other version.

For example after using your module it makes these dependecies:
[email protected], lodash@^4.0.0, lodash@^4.11.1, lodash@^4.17.10, lodash@^4.17.4, lodash@^4.17.5, lodash@^4.2.0, lodash@^4.3.0, lodash@~4.17.4

as you can see there are multiple differenent versions required. But all begins with caret symbol (^) can increase minor version. And there is one with tilde (~) so patch version can be increased.

But your module doesn't use any characted. So only lodash version 4.17.10 is used within whole app.

Currently it is not problem because lodash latest version is 4.17.10, but in future lodash can't be updated.

Add possibility to define port, protocol, ...

update lodash version

can you update lodash to the latest version. The used version is vulnerability and need to be update as soon as possible

Release a new version

You fixed lodash last prototype pollution with this commit: 9c64412. Great! Could you please release it so we can ugrade forcedomain version?

No port in `Host` headers versus port 80 in options

(some background in this SO comment)

When an incoming request doesn't have a port number in the Host header, forcedomain uses a value of undefined to match against the port value passed in the options. This means that setting a port value of 80 in the options will cause redirect loops (because undefined !== 80).

This behaviour is somewhat documented, but not very explicitly. I think that most users will assume that passing port : 80 works just like it does with any other port number.

FWIW, passing a string value as port number also yields unexpected behaviour (which was the reason for the abovementioned SO question being asked to begin with).

Only root?

It seems like this works for the root of the website but not for other urls., e.g.

https://risiko.online --> https://www.risiko.online
https://risiko.online/demo --> https://risiko.online/demo

Is this the expected behavior or am I doing something wrong?

Thanks!! :-)

Default redirect is not permanent (301)

Hi,

I've just testest forcedomain, but I got an issue:

// forcedomain
app.use(force({
    hostname : 'mywebsite.com'
}));

make a 307 redirect, for a 301 redirect, I needed to

app.use(force({
    hostname : 'mywebsite.com',
    type     : 'permanent' 
}));

Is that the default behavior ?

Adding `dev` option to support `lvh.me`

I use lvh.me since my app has subdomain and I can't use localhost, 127.0.0.1, nor 192.168.x.x for that. In my production and staging environment, this package works well on redirecting non-www to www.

Code:

app.use(forceDomain({ hostname: `www.${host}` }));

But in my dev environment, I am getting too many redirects error. For it to work on dev, I need to add port: 3001 and make sure to not commit it.

I am thinking that we can add another option like this:

forceDomain({ dev: process.env.NODE_ENV === 'development' });

Where dev option is a boolean, that if it's a dev environment don't use forcedomain.

I think the condition can be added here:
https://github.com/thenativeweb/forcedomain/blob/master/lib/redirect.ts#L20

This way we can make use of process.env.NODE_ENV variable for the value of dev.

What do you think? I can work on this if it's welcome.

If not I will just create a condition on my app to use port if it's dev.

prevent https from being redirected to http

So I'm using it as following and my site uses the following;

app.use(forceDomain({ hostname: 'www.mydomain.com' }));

The thing is that it tries to redirect to http version of the same url within https - this should be prevented.

code:

if (process.env.NODE_ENV === "production") {
  console.log("--- NODE_ENV: ", process.env.NODE_ENV);
  app.use(req => {
    console.log("-- what is the host? ", req.get("host"));
    console.log( "-- what is the host replaced? ", req.get("host").replace("www.", ""));

    return forceDomain({
      hostname: req.get("host").replace("www.", ""),
      protocol: "https"
    });
  });
}

output:

what is the : host?  www.mysite-env.sa-east-1.elasticbeanstalk.com
what is the host replaced?  misite-env.sa-east-1.elasticbeanstalk.com