Use req.secure if it is set

helmetjs · Sep 26, 2012 · 4495de2 · 4495de2
1 parent af1137c
commit 4495de2
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/middleware/hsts.js b/lib/middleware/hsts.js
@@ -12,7 +12,7 @@ module.exports = function (maxAge, includeSubdomains) {
     if (includeSubdomains) header += '; includeSubdomains';
 
     return function (req, res, next)  {
-        if (req.connection.encrypted) {
+        if (typeof req.secure !== "undefined" ? req.secure : req.connection.encrypted) {
             res.header('Strict-Transport-Security', header);
         }
         next();