Skip to content

Commit ed1cf05

Browse files
committed
enforce ssl
1 parent eea4693 commit ed1cf05

File tree

2 files changed

+42
-0
lines changed

2 files changed

+42
-0
lines changed

common/enforce-ssl.js

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
module.exports = function(options) {
2+
options = options ? options : {};
3+
const maxAge = options.maxAge ? options.maxAge : 86400;
4+
const includeSubDomains =
5+
options.includeSubDomains === undefined ? true : options.includeSubdomains;
6+
7+
return function(req, res, next) {
8+
let ignoreRequest = process.env.NODE_ENV !== 'production';
9+
const secure =
10+
req.connection.encrypted || req.get('X-Forwarded-Proto') === 'https';
11+
12+
if (options.ignoreFilter) {
13+
ignoreRequest = ignoreRequest || options.ignoreFilter(req);
14+
}
15+
16+
if (ignoreRequest) {
17+
next();
18+
return;
19+
}
20+
21+
if (secure) {
22+
let header = 'max-age=' + maxAge;
23+
if (includeSubDomains) {
24+
header += '; includeSubDomains';
25+
}
26+
27+
if (options.preload) {
28+
header += '; preload';
29+
}
30+
31+
res.setHeader('Strict-Transport-Security', header);
32+
next();
33+
} else {
34+
res.writeHead(301, {
35+
Location: 'https://' + req.get('host') + req.url,
36+
});
37+
res.end();
38+
}
39+
};
40+
};

server.js

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import cookieParser from 'cookie-parser';
1010
import passport from 'passport';
1111
import setupAuth from './api/auth';
1212
import setupApi from './api';
13+
import enforceSSL from './common/enforce-ssl';
1314

1415
import queries from './api/controllers/queries';
1516
import { User, Comment, Post } from './api/models';
@@ -26,6 +27,7 @@ app.prepare().then(() => {
2627
server.use(compression());
2728
}
2829

30+
server.use(enforceSSL());
2931
server.use('/static', express.static(__dirname + '/static'));
3032
server.use(cookieParser());
3133
server.use(morgan('dev'));

0 commit comments

Comments
 (0)