express: force SSL

vincentbernat · Jul 7, 2015 · 499b79f · 499b79f
1 parent 6dcc214
commit 499b79f
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 1 deletion.
diff --git a/lib/config.js b/lib/config.js
@@ -57,7 +57,8 @@ nconf
            // Other stuff
            port: 9400,
            demo: false,
-           secret: 'changeThisLameSecretPassphrase!!'
+           secret: 'changeThisLameSecretPassphrase!!',
+           forcessl: false
          }
        });
 

diff --git a/lib/express.js b/lib/express.js
@@ -15,6 +15,18 @@ if (app.get('env') === 'development') {
   }));
 }
 
+
+
+if (config.get('forcessl')) {
+  var forceSsl = function(req, res, next) {
+    if (req.headers['x-forwarded-proto'] !== 'https') {
+      return res.redirect(['https://', req.get('Host'), req.url].join(''));
+    }
+  return next();
+  };
+  app.use(forceSsl);
+}
+
 app.use(express.static(config.get('path:static')));
 app.use(methodOverride());
 logger.express.access(app);