You requested an insecure resource. Please use this instead: \n' + ' ' + encodeURI(newLocation) + '
\n' + '\n' + '\n' ; // DO NOT HTTP REDIRECT /* res.setHeader('Location', newLocation); res.statusCode = 302; */ // BAD NEWS BEARS // // When people are experimenting with the API and posting tutorials // they'll use cURL and they'll forget to prefix with https:// // If we allow that, then many users will be sending private tokens // and such with POSTs in clear text and, worse, it will work! // To minimize this, we give browser users a mostly optimal experience, // but people experimenting with the API get a message letting them know // that they're doing it wrong and thus forces them to ensure they encrypt. res.setHeader('Content-Type', 'text/html'); res.end(metaRedirect); } // TODO localhost-only server shutdown mechanism // that closes all sockets, waits for them to finish, // and then hands control over completely to respawned server // // Redirect HTTP to HTTPS // // This simply redirects from the current insecure location to the encrypted location // var insecureServer; insecureServer = http.createServer(); insecureServer.on('request', redirectHttps); insecureServer.listen(insecurePort, function () { console.log("\nListening on https://localhost:" + insecureServer.address().port); console.log("(redirecting all traffic to https)\n"); }); };