Automatic HTTPS Connection/redirect With Node.js/express

Answer :

Ryan, thanks for pointing me in the right direction. I fleshed out your answer (2nd paragraph) a little bit with some code and it works. In this scenario these code snippets are put in my express app:

// set up plain http server var http = express();  // set up a route to redirect http to https http.get('*', function(req, res) {       res.redirect('https://' + req.headers.host + req.url);      // Or, if you don't want to automatically detect the domain name from the request header, you can hard code it:     // res.redirect('https://example.com' + req.url); })  // have it listen on 8080 http.listen(8080); 

The https express server listens ATM on 3000. I set up these iptables rules so that node doesn't have to run as root:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080 iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 3000 

All together, this works exactly as I wanted it to.

To prevent theft of cookies over HTTP, see this answer (from the comments) or use this code:

const session = require('cookie-session'); app.use(   session({     secret: "some secret",     httpOnly: true,  // Don't let browser javascript access cookies.     secure: true, // Only use cookies over https.   }) ); 

Thanks to this guy: https://www.tonyerwin.com/2014/09/redirecting-http-to-https-with-nodejs.html

app.use (function (req, res, next) {         if (req.secure) {                 // request was via https, so do no special handling                 next();         } else {                 // request was via http, so redirect to https                 res.redirect('https://' + req.headers.host + req.url);         } }); 

If you follow conventional ports since HTTP tries port 80 by default and HTTPS tries port 443 by default you can simply have two server's on the same machine: Here's the code:

var https = require('https');  var fs = require('fs'); var options = {     key: fs.readFileSync('./key.pem'),     cert: fs.readFileSync('./cert.pem') };  https.createServer(options, function (req, res) {     res.end('secure!'); }).listen(443);  // Redirect from http port 80 to https var http = require('http'); http.createServer(function (req, res) {     res.writeHead(301, { "Location": "https://" + req.headers['host'] + req.url });     res.end(); }).listen(80); 

Test with https:

$ curl https://127.0.0.1 -k secure! 

With http:

$ curl http://127.0.0.1 -i HTTP/1.1 301 Moved Permanently Location: https://127.0.0.1/ Date: Sun, 01 Jun 2014 06:15:16 GMT Connection: keep-alive Transfer-Encoding: chunked 

More details : Nodejs HTTP and HTTPS over same port