Question

I have an app which is quite normal Express app – simple server logic, views, lots of client-side JS.
I have to do many AJAX requests. Some of them need to be secured by HTTPS protocol (some needn’t).

So, my server should work with both HTTP and HTTPS.
It should also work o both the local machine (ran with nodemon normally) and on Heroku.

As far as I understood, Heroku gives you a single port (process.env.PORT) you can listen to, and handles all requests through the proxy (so, you app is listening to this port and not bothering about the proto – right?)

So, am I getting this right – I should have some different code for dev machine and Heroku?

Like

...
app = express()
...

if process.env.NODE_ENV == 'production'
  app.listen(process.env.PORT)
else
  https = require('https')
  http = require('http')
  http.createServer(app).listen(5080) # some local port
  options = {
    key: fs.readFileSync('key.pem'), 
    cert: fs.readFileSync('cert.pem') # my self-signed files
  }
  https.createServer(options, app).listen(5443) # some different local port

Is it the proper way to deal with this?

Answer 1

Well, community looks quite dead these days (hope I’m wrong)

The answer is:

a) yes, this is the way to deal with it

b) the way to check if you are in secure mode or not depends on the environment as well:

if process.env.NODE_ENV == 'production'
  is_secure = (req) ->
    req.headers['x-forwarded-proto'] == 'https'
else
  is_secure = (req) -> req.secure

ADD
If you wish to force HTTPS:

redirect_to_https = (req, res, next) ->
  if not is_secure(req)
    res.redirect config.SECURE_DOMAIN + req.url
  else
    next()

app
  .use(redirect_to_https)