coolaj86
/
redirect-https.js
1
0
Fork 0
Code Issues Pull Requests Releases Activity
Redirect from HTTP to HTTPS using meta redirects
27 Commits 1 Branch 7 Tags 48 KiB
JavaScript 100%
Go to file
AJ ONeal 2b7805c87b add .js 2018-10-02 23:53:28 +00:00
.gitignore Initial commit 2015-06-19 09:15:45 -06:00
LICENSE Initial commit 2015-06-19 09:15:45 -06:00
README.md add .js 2018-10-02 23:53:28 +00:00
example.js option for URI decoded, but still html escaped urls 2015-07-07 17:30:56 -06:00
index.js v1.2.0: browsers shall pass, apis... not so much 2018-10-02 17:49:24 -06:00
package.json v1.2.0: browsers shall pass, apis... not so much 2018-10-02 17:49:24 -06:00
test.js fix #2 2016-11-21 15:45:05 -07:00

README.md

redirect-https.js

Redirect from HTTP to HTTPS.

Makes for a seemless experience to end users in browsers (defaults to 301 Permanent + Location redirect) and tightens security for apis and bots, without adversely affecting strange browsers (fallback to meta redirect).

See https://coolaj86.com/articles/secure-your-redirects/

Installation and Usage

npm install --save redirect-https

'use strict';

var express = require('express');
var app = express();

app.use('/', require('redirect-https')({
  body: '<!-- Hello Mr Developer! Please use HTTPS instead -->'
}));

module.exports = app;

Options

{ port: 443           // defaults to 443
, body: ''            // defaults to an html comment to use https
, trustProxy: true    // useful if you haven't set this option in express
, browsers: 301       // issue 301 redirect if the user-agent contains "Mozilla/"
, apis: 'meta'        // issue meta redirects to non-browsers
}
  • This module will call next() if the connection is already tls / https.
  • If trustProxy is true, and X-Forward-Proto is https, next() will be called.
  • If you use {{URL}} in the body text it will be replaced with a URI encoded and HTML escaped url (it'll look just like it is)
  • If you use {{HTML_URL}} in the body text it will be replaced with a URI decoded and HTML escaped url (it'll look just like it would in Chrome's URL bar)

Demo

'use strict';

var http = require('http');
var server = http.createServer();
var securePort = process.argv[2] || 8443;
var insecurePort = process.argv[3] || 8080;

server.on('request', require('redirect-https')({
  port: securePort
, body: '<!-- Hello! Please use HTTPS instead -->'
, trustProxy: true // default is false
}));

server.listen(insecurePort, function () {
  console.log('Listening on http://localhost.pplwink.com:' + server.address().port);
});

Meta redirect by default, but why?

When something is broken (i.e. insecure), you don't want it to kinda work, you want developers to notice.

Using a meta redirect will break requests from curl and api calls from a programming language, but still have all the SEO and speed benefits of a normal 301.

<html><head>
<meta http-equiv="refresh" content="0;URL='https://example.com/foo'" />
</head><body>
<!-- Hello Mr. Developer! Please use https instead. Thank you! -->
</html>

Other strategies

If your application is properly separated between static assets and api, then it would probably be more beneficial to return a 200 OK with an error message inside

Security

The incoming URL is already URI encoded by the browser but, just in case, I run an html escape on it so that no malicious links of this sort will yield unexpected behavior:

  • http://localhost.pplwink.com:8080/"><script>alert('hi')</script>
  • http://localhost.pplwink.com:8080/';URL=http://example.com
  • http://localhost.pplwink.com:8080/;URL=http://example.com