Add a note that this isn't very safe

[Haroenv]

It means that people could disable JS, or just this part of it and are able to stay on http. It's better to use HSTS and redirect to https server side.

Have a nice day!

[mbasso]

Thank you @Haroenv. Just add this note

The element redirects the current page to HTTPS, unless the page is loaded from a web server running on localhost. Using HTTP Strict Transport Security (HSTS) can be used to enforce HTTPS for an entire origin, following the first visit to any page on the origin. Configuring the underlying web server to redirect all HTTP requests to their HTTPS equivalents takes care of enforcing HTTPS on the initial visit as well. Both options provide a more robust approach to enforcing HTTPS, but require access to the underlying web server's configuration in order to implement. This element provides a client-side option when HSTS and server-enforced redirects aren't possible, such as when deploying code on a shared-hosting provider like GitHub Pages.

[Haroenv]

Perfect!

[fabiosantoscode]

I don't think the note is very clear on this being a worse solution than HSTS or a HTTPS redirect...

Not to say the project isn't useful, of course, as the note explains.

[mbasso]

Maybe we can add a warning under the badges that highlights it. Something like:
“⚠️ Security note ⚠️ - This element provides a client-side option when HSTS and server-enforced redirects aren't possible. Please don’t use this if you can configure the server”

What do you think about it?

[fabiosantoscode]

I think that would be great!

[mbasso]

Perfect!

[CristianoYL]

Hi there,

Thanks for sharing this library. It does exactly what I need. However, I do have a question. This thread seems very related so I chose to post it here.

I'm using it with a React App deployed on Heroku, which means I do not have access to the server configs. So neither HSTS nor server redirect is possible, I suppose. Then react-https-redirect seems to be the only option.

I'm wondering why it would be a less secure method? Is there any reason other than what Fabio mentioned above? If that's the only reason, would this piece of code help solving it? It's added to the index.html by default with CRA.

<noscript>
    You need to enable JavaScript to run this app.
</noscript>

Please let me know. Thank you!

[mbasso]

Hi @CristianoYL,
unfortunately that code shows only a message if javascript is disabled, people can use your page in http without problems. Also, consider that everyone can inspect and execute javascript disabling only react-https-redirect... for this reason is better a server side solution