# redirect-https

> Redirect from HTTP to HTTPS using meta redirects

Latest version **1.3.1** (published 2020-04-26) · (MIT OR Apache-2.0) license · 0 weekly downloads

## Install

```sh
npm install redirect-https
pnpm add redirect-https
yarn add redirect-https
bun add redirect-https
```

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 1.3.1 |
| Published | 2020-04-26 |
| First published | 2015-07-07 |
| Weekly downloads | 0 |
| License | (MIT OR Apache-2.0) |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 1 |
| Unpacked size | 21 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Author | AJ ONeal |
| Maintainers | coolaj86 |
| Keywords | https, http, redirect, force, upgrade, location, meta |

## Links

- npm: https://www.npmjs.com/package/redirect-https
- Repository: https://git.coolaj86.com/coolaj86/redirect-https.js
- Homepage: https://git.coolaj86.com/coolaj86/redirect-https.js#readme
- Issues: https://git.coolaj86.com/coolaj86/redirect-https.js/issues
- npm.io page: https://npm.io/package/redirect-https

## Dependencies (1)

- [escape-html](https://npm.io/package/escape-html.md) ^1.0.3

## Alternatives

- [jsforce](https://npm.io/package/jsforce.md) — 851.2K weekly downloads
- [react-native-qrcode-svg](https://npm.io/package/react-native-qrcode-svg.md) — 693.5K weekly downloads
- [@salesforce/plugin-data](https://npm.io/package/@salesforce/plugin-data.md) — 394.9K weekly downloads
- [@backstage/plugin-search-common](https://npm.io/package/@backstage/plugin-search-common.md) — 308.5K weekly downloads
- [@chain-registry/types](https://npm.io/package/@chain-registry/types.md) — 38.4K weekly downloads

## Recent versions

- 1.3.1 (latest) — 2020-04-26
- 1.3.0 — 2018-10-03
- 1.2.0 — 2018-10-02
- 1.1.6 — 2018-08-17
- 1.1.5 — 2018-02-27
- 1.1.2 — 2018-02-26
- 1.1.4 — 2017-05-05
- 1.1.3 — 2017-05-05
- 1.1.1 — 2016-11-21
- 1.1.0 — 2015-07-07
- 1.0.0 — 2015-07-07

## README

# redirect-https.js

Secure-by-default redirects from HTTP to HTTPS.

-   Browsers get a 301 + Location redirect
-   Only developers, bots, and APIs see security warning (advising to use HTTPS)
-   Always uses meta redirect as a fallback, for everyone
-   '/' always gets a 301 (for `curl | bash` installers)
-   minimally configurable, don't get fancy

See <https://coolaj86.com/articles/secure-your-redirects/>

## Installation and Usage

```bash
npm install --save redirect-https
```

```js
"use strict";

var express = require("express");
var app = express();

var redirector = require("redirect-https")({
    body: "<!-- Hello Developer! Please use HTTPS instead: {{ URL }} -->"
});

app.use("/", redirector);

module.exports = app;
```

## Options

```js
{ port: 443           // defaults to 443
, body: ''            // defaults to an html comment to use https
, trustProxy: true    // useful if you haven't set this option in express
, browsers: 301       // issue 301 redirect if the user-agent contains "Mozilla/"
, apis: 'meta'        // issue meta redirects to non-browsers
}
```

-   This module will call `next()` if the connection is already tls / https.
-   If `trustProxy` is true, and `X-Forward-Proto` is https, `next()` will be called.
-   `{{ URL }}` in the body text will be replaced with a URI encoded and HTML escaped url (it'll look just like it is)
-   `{{ HTML_URL }}` in the body text will be replaced with a URI decoded and HTML escaped url (it'll look just like it would in Chrome's URL bar)
-   `{{ UNSAFE_URL }}` is the raw, original url

## Demo

```javascript
"use strict";

var http = require("http");
var server = http.createServer();
var securePort = process.argv[2] || 8443;
var insecurePort = process.argv[3] || 8080;

var redirector = require("redirect-https")({
    port: securePort,
    body: "<!-- Hello! Please use HTTPS instead: {{ URL }} -->",
    trustProxy: true // default is false
});

server.on("request", redirector);

server.listen(insecurePort, function () {
    console.log(
        "Listening on http://localhost.rootprojects.org:" +
            server.address().port
    );
});
```

## Advanced Options

For the sake of `curl | bash` installers and the like there is also the option to cause bots and apis (i.e. curl)
to get a certain redirect for an exact path match:

```js
{
    paths: [
        { match: "/", redirect: 301 },
        { match: /^\/$/, redirect: 301 }
    ];
}
```

If you're using this, you're probably getting too fancy (but hey, I get too fancy sometimes too).

# Meta redirect by default, but why?

When something is broken (i.e. insecure), you don't want it to kinda work, you want developers to notice.

Using a meta redirect will break requests from `curl` and api calls from a programming language, but still have all the SEO and speed benefits of a normal `301`.

```html
<html><head>
<meta http-equiv="refresh" content="0;URL='https://example.com/foo'" />
</head><body>
<!-- Hello Mr. Developer! Please use https instead. Thank you! -->
</html>
```

# Other strategies

If your application is properly separated between static assets and api, then it would probably be more beneficial to return a 200 OK with an error message inside

# Security

The incoming URL is already URI encoded by the browser but, just in case, I run an html escape on it
so that no malicious links of this sort will yield unexpected behavior:

-   `http://localhost.rootprojects.org:8080/"><script>alert('hi')</script>`
-   `http://localhost.rootprojects.org:8080/';URL=http://example.com`
-   `http://localhost.rootprojects.org:8080/;URL=http://example.com`

---
_Source: https://npm.io/package/redirect-https · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._