You requested an insecure resource. Please use this instead: \n' + ' ' + safeLocation + '
\n' + '\n' + '\n' ; // DO NOT HTTP REDIRECT /* res.setHeader('Location', newLocation); res.statusCode = 302; */ // BAD NEWS BEARS // // When people are experimenting with the API and posting tutorials // they'll use cURL and they'll forget to prefix with https:// // If we allow that, then many users will be sending private tokens // and such with POSTs in clear text and, worse, it will work! // To minimize this, we give browser users a mostly optimal experience, // but people experimenting with the API get a message letting them know // that they're doing it wrong and thus forces them to ensure they encrypt. res.setHeader('Content-Type', 'text/html; charset=utf-8'); res.end(metaRedirect); } // TODO localhost-only server shutdown mechanism // that closes all sockets, waits for them to finish, // and then hands control over completely to respawned server // // Redirect HTTP to HTTPS // // This simply redirects from the current insecure location to the encrypted location // var insecureServer; insecureServer = http.createServer(); insecureServer.listen(insecurePort, function () { console.log("\nListening on http://localhost:" + insecureServer.address().port); console.log("(handling any explicit redirects and redirecting all other traffic to https)\n"); if (serverCallback) { appPromise = serverCallback(null, insecureServer); } }); if (lex) { var LEX = require('letsencrypt-express'); insecureServer.on('request', LEX.createAcmeResponder(lex, redirectHttps)); } else { insecureServer.on('request', redirectHttps); } return PromiseA.resolve(insecureServer); };