📱 Get proto from Forwarded header

Author: jysperm

middleware/https-redirect.js

@@ -1,11 +1,16 @@
 'use strict';
 
 var endsWith = require('../lib/utils').endsWith;
+var getForwardedClient = require('../lib/utils').getForwardedClient;
+var _ = require('underscore');
 
 module.exports = function(AV) {
   return function() {
     return function(req, res, next) {
-      if ((AV.Cloud.__prod || endsWith(req.headers.host, '.leanapp.cn')) && (!req.secure)) {
+      var forwardedClient = getForwardedClient(req)
+
+      if (forwardedClient && forwardedClient.proto === 'http' && !_.include(['loopback', 'private'], forwardedClient.range) ||
+          !forwardedClient && (AV.Cloud.__prod || endsWith(req.headers.host, '.leanapp.cn')) && (!req.secure)) {
         const url = `https://${req.headers.host}${req.originalUrl || req.url}`;
 
         res.statusCode = 302;

test/express/https-redirect-test.js

@@ -16,6 +16,13 @@ app.get('/test', function (req, res) {
 });
 
 describe('https-redirect', function() {
+  var prod = AV.Cloud.__prod
+
+  afterEach(function() {
+    // rollback changes on AV.Cloud.__prod
+    AV.Cloud.__prod = prod
+  })
+
   it('should redirect', function(done) {
     request(app)
       .get('/test')
@@ -43,4 +50,42 @@ describe('https-redirect', function() {
       .expect(200)
       .expect("Hello World!", done);
   });
+
+  it('should redirect (Forwarded, custom domain on staging)', function(done) {
+    AV.Cloud.__prod = 0
+
+    request(app)
+      .get('/test')
+      .set('Host', 'stg-custom.domain.com')
+      .set('Forwarded', 'for=1.2.3.4; proto=http, for=10.0.0.1')
+      .expect(302)
+      .end(function(err, res) {
+        res.headers.location.should.equal('https://stg-custom.domain.com/test');
+        done();
+      })
+  });
+
+  it('should not redirect (Forwarded, intranet)', function(done) {
+    AV.Cloud.__prod = 0
+
+    request(app)
+      .get('/test')
+      .set('Host', 'stg-custom.domain.com')
+      .set('Forwarded', 'for=10.0.0.1; proto=http')
+      .set('X-Forwarded-Proto', 'http')
+      .expect(200)
+      .expect("Hello World!", done);
+  });
+
+  it('should not redirect (Forwarded overwrite X-Forwarded-Proto)', function(done) {
+    AV.Cloud.__prod = 0
+
+    request(app)
+      .get('/test')
+      .set('Host', 'stg-custom.domain.com')
+      .set('Forwarded', 'for=1.2.3.4; proto=https, for=10.0.0.1; proto=http')
+      .set('X-Forwarded-Proto', 'http')
+      .expect(200)
+      .expect("Hello World!", done);
+  });
 });