HTTPS redirection for all routes node.js/express - Security concerns

Question

I recently took a stab at setting up HTTPS on a node/express server. I have successfully managed to redirect all the routes to use https using the code below:

// force https redirect
var https_redirect = function(req, res, next) {
  if (req.secure) {
    if(env === 'development') {
      return res.redirect('https://localhost:3000' + req.url);
    } else {
      return res.redirect('https://' + req.headers.host + req.url);
    }
  } else {
    return next();
  }
};

app.get('*', function(req, res, next) {
  https_redirect(req, res, next);
});

This seems to be working fine. However, since I havent' dabbled into this before I have a couple of questions:

Is this the ideal way to redirect from http to https?
If a user uses the http route, prior to the redirect is it possible for anyone to use something like sslstrip to sniff out session info.

node: v0.8.2 ; express: v3.05

score 43 · Accepted Answer · answered Apr 05 '13 at 07:28

43

function requireHTTPS(req, res, next) {
    if (!req.secure) {
        //FYI this should work for local development as well
        return res.redirect('https://' + req.get('host') + req.url);
    }
    next();
}

app.use(requireHTTPS);
app.get('/', routeHandlerHome);

The middleware approach will work because express will run the middleware in the order added, before it runs the router, and in general this kind of site-wide policy is cleaner as middleware vs. a wildcard route.

Regarding question 2 about sniffing session cookies, that must be addressed by marking the cookies as secure when you set them. If they haven't been marked secure, the browser will transmit them with HTTP requests as well, thus exposing them to sniffing.

answered Apr 05 '13 at 07:28

Peter Lyons

142,938
30
279
274

2

This is great, but it's slightly problematic for development if you're using non-standard (80 for HTTP, 443 for HTTPS), because it tries to redirect to `https://localhost:[PORT]`. A workaround is to set an `SSL_PORT` environment variable in the `development` environment, and, if it's defined, replace the port. See [here](https://gist.github.com/gingi/47df42a45bb1653002ee#file-gistfile1-js-L5-L8) for the modified snippet. – Gingi Jun 12 '14 at 14:21
hei, how can I connect with a front-end client after doing this ? Thanks ! – alexsc May 12 '15 at 12:46
As a note, on heroku you have to use `req.headers['x-forwarded-proto'] !== 'https'` or else this will not work. See http://stackoverflow.com/questions/7185074/heroku-nodejs-http-to-https-ssl-forced-redirect – S.Kiers Apr 07 '17 at 05:48

score 2 · Answer 2 · answered Apr 04 '13 at 15:21

2

You can simply use your https_redirect function (though a bit modified) as a to automatically redirect all of your secure requests:

// force https redirect
var https_redirect = function () {
  return function(req, res, next) {
    if (req.secure) {
      if(env === 'development') {
        return res.redirect('https://localhost:3000' + req.url);
      } else {
        return res.redirect('https://' + req.headers.host + req.url);
      }
    } else {
      return next();
    }
  };
};
app.use(https_redirect());

app.get('/', routeHandlerHome);

answered Apr 04 '13 at 15:21

red

3,163
1
17
16

Hey Josh. Thanks for the reply. Can you highlight how your approach specifically with app . use would work as compared to my implementation. – los7world Apr 05 '13 at 02:40
@los7world: With app.use(), you're specifically setting up a middleware with no route matching, thus all your routes will pass through it. – red Apr 05 '13 at 13:50
1

Shouldn't this first condition be `!req.secure` – Mladen Janjetovic Dec 13 '16 at 09:27

score 0 · Answer 3 · answered Dec 14 '15 at 21:08

I use this simple code to redirect requests depending on whether the application is in development or production.

// force https redirect
var forceHTTPS = function () {
  return function(req, res, next) {
    if (!req.secure) {
      if (app.get('env') === 'development') {
         return res.redirect('https://localhost:3001' + req.url);
      } else {
        return res.redirect('https://' + req.headers.host + req.url);
      }
    } else {
      return next();
    }
  };
};

HTTPS redirection for all routes node.js/express - Security concerns

3 Answers3

Linked