Heroku SSL error

[jwelton]

I'm not sure if I've misunderstood something, but for some reason express-force-ssl is not recognizing Heroku's SSL connections. If I set enable301Redirects to false and access through either http or https, then I can the error message. This this to true Google Chrome gives me an error in chrome saying too many redirects were attempted.

Its important to note here that Google Chrome does say that the connection is private and successful. I've included the connection details below.

Any ideas?

[battlejj]

Hey @jwelton sorry I missed this notification come in.

I haven't seen this one before but admittedly am not familiar with Heroku deployment. Do you mind posting your relevant config (i.e. anything that has to do with the library) and I'll do some poking around?

[jwelton]

Thanks for the reply @battlejj. I think I may of found the problem. I've actually found a good blog post about the issue. To quote the blog:

The Express request object has a bunch of great information. One of its attributes is secure. It’s a boolean. Usually, secure == true will mean that you’re on https. When that is not true, you’re ready for a redirect.

Unfortunately for apps hosted on Heroku, request.secure will always be false. The way that Heroku routing works, it will just never be set.

It's not all bad news. They have actually posted a solution to the problem. Turns out that Heroku do pass something onto us we can use (again I'm quoting the blog below)!

Instead, Heroku forwards an http header that allows us to do the same “is secure” test. On Heroku, request.header('x-forwarded-proto') will contain the actual protocol string (eg, ‘http’ or ‘https’).

I can confirm that I've tested this method and it does indeed work. For completeness, this is the code I used during testing:

app.use('*',function(req,res,next){
if(req.headers['x-forwarded-proto']!='https')
  return res.redirect(['https://', req.get('Host'), req.url].join(''));
else
  next()
})

I wonder if there is a way to build in a check for the Heroku header into this library? Here is a link to the blog post I have quoted above:
http://jaketrent.com/post/https-redirect-node-heroku/

[battlejj]

Happy to help. The library actually does support the x-forwarded-proto header. By default the support is disabled since it is possible to spoof this header. To enable this the trustXFPHeader option needs to be set to true in your config. Check out the README for a quick example.

Let me know if you still have problems after enabling the feature.