coolaj86/redirect-https.js
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Compare commits

base: coolaj86:2b7805c87b4a2854be9bb55b02ebe52835059228
Branches Tags
coolaj86:master
coolaj86:v1.3.1
coolaj86:v1.3.0
coolaj86:v1.1.6
coolaj86:v1.1.5
coolaj86:v1.1.1
coolaj86:v1.1.0
coolaj86:v1.0.0
..
compare: coolaj86:7375a550eb936814a17f1db154a315579b28afad
Branches Tags
coolaj86:master
coolaj86:v1.3.1
coolaj86:v1.3.0
coolaj86:v1.1.6
coolaj86:v1.1.5
coolaj86:v1.1.1
coolaj86:v1.1.0
coolaj86:v1.0.0

2 Commits
2b7805c87b ... 7375a550eb

Author SHA1 Message Date
AJ ONeal
7375a550eb Merge branch 'master' of ssh://git.coolaj86.com:22042/coolaj86/redirect-https.js 2018-10-02 19:07:22 -06:00
AJ ONeal
fd044d6467 v1.3.0: redirect root '/' with 301 by default (for curl | bash installers) 2018-10-02 18:25:04 -06:00
3 changed files with 44 additions and 5 deletions
Show Stats Expand all files Collapse all files

30
README.md
View File

@ -1,9 +1,12 @@
# redirect-https.js # redirect-https.js
Redirect from HTTP to HTTPS. Secure-by-default redirects from HTTP to HTTPS.
Makes for a seemless experience to end users in browsers (defaults to `301 Permanent + Location` redirect) * Browsers get a 301 + Location redirect
and tightens security for apis and bots, without adversely affecting strange browsers (fallback to `meta` redirect). * Only developers, bots, and APIs see security warning (advising to use HTTPS)
* Always uses meta redirect as a fallback, for everyone
* '/' always gets a 301 (for `curl | bash` installers)
* minimally configurable, don't get fancy
See <https://coolaj86.com/articles/secure-your-redirects/> See <https://coolaj86.com/articles/secure-your-redirects/>
@ -28,7 +31,7 @@ module.exports = app;
## Options ## Options
``` ```js
{ port: 443 // defaults to 443 { port: 443 // defaults to 443
, body: '' // defaults to an html comment to use https , body: '' // defaults to an html comment to use https
, trustProxy: true // useful if you haven't set this option in express , trustProxy: true // useful if you haven't set this option in express
@ -42,6 +45,25 @@ module.exports = app;
* If you use `{{URL}}` in the body text it will be replaced with a URI encoded and HTML escaped url (it'll look just like it is) * If you use `{{URL}}` in the body text it will be replaced with a URI encoded and HTML escaped url (it'll look just like it is)
* If you use `{{HTML_URL}}` in the body text it will be replaced with a URI decoded and HTML escaped url (it'll look just like it would in Chrome's URL bar) * If you use `{{HTML_URL}}` in the body text it will be replaced with a URI decoded and HTML escaped url (it'll look just like it would in Chrome's URL bar)
## Advanced Options
For the sake of `curl | bash` installers and the like there is also the option to cause bots and apis (i.e. curl)
to get a certain redirect for an exact path match:
```js
{ paths: [
{ match: '/'
, redirect: 301
}
, { match: /^\/$/
, redirect: 301
}
]
}
```
If you're using this, you're probably getting too fancy (but hey, I get too fancy sometimes too).
## Demo ## Demo
```javascript ```javascript

17
index.js
View File

@ -15,6 +15,9 @@ module.exports = function (opts) {
if (!opts.apis) { if (!opts.apis) {
opts.apis = 'meta'; opts.apis = 'meta';
} }
if (!Array.isArray(opts.paths)) {
opts.paths = [ { match: '/' } ];
}
if (!('body' in opts)) { if (!('body' in opts)) {
opts.body = "<!-- Hello Developer Person! We don't serve insecure resources around here." opts.body = "<!-- Hello Developer Person! We don't serve insecure resources around here."
+ "\n Please use HTTPS instead. -->"; + "\n Please use HTTPS instead. -->";
@ -68,7 +71,21 @@ module.exports = function (opts) {
+ '<body>\n' + body + '\n</body>\n' + '<body>\n' + body + '\n</body>\n'
+ '</html>\n' + '</html>\n'
; ;
var pathMatch;
opts.paths.some(function (p) {
if (!p.match) {
// ignore
} else if ('string' === typeof p.match) {
pathMatch = (url === p.match) && (p.redirect || 301);
} else {
pathMatch = p.match.test && p.match.test(url) && (p.redirect || 301);
}
if (pathMatch) {
redirect = pathMatch;
}
return pathMatch;
});
// If it's not a non-0 number (because null is 0) then 'meta' is assumed. // If it's not a non-0 number (because null is 0) then 'meta' is assumed.
if (redirect && isFinite(redirect)) { if (redirect && isFinite(redirect)) {
res.statusCode = redirect; res.statusCode = redirect;

2
package.json
View File

@ -1,6 +1,6 @@
{ {
"name": "redirect-https", "name": "redirect-https",
"version": "1.2.0", "version": "1.3.0",
"description": "Redirect from HTTP to HTTPS using meta redirects", "description": "Redirect from HTTP to HTTPS using meta redirects",
"main": "index.js", "main": "index.js",
"scripts": { "scripts": {