visionmedia/express — Issue #927: Redirect should respect X-Forwarded-Proto header
Author: lukegalea
Created: 2011-12-08 19:26:46+00:00
State: open

If you use something like NginX in front of express to terminate SSL, redirects sent from express will be to the http rather than https URL. The request header X-Forwarded-Proto is widely supported as a way for the load balancer/SSL terminator to indicate that the request is actually being served via SSL.

A minor change to response.js would handle this:

express / lib / response.js:
res.redirect = function(url){
...
var host = req.headers.host
, forwardedProto = req.header("X-Forwarded-Proto")
, tls = forwardedProto ? forwardedProto === 'https' : req.connection.encrypted;
url = 'http' + (tls ? 's' : '') + '://' + host + url;