Merge pull request #142 from trailimage/develop

add requireSSL method

CHANGELOG.md

@@ -1,3 +1,7 @@
+## 4.1.0
+
+-  Add option to require an SSL connection
+
 ## 4.0.2
 
 -  Fix unhandled error for missing GPX

package.json

@@ -1,7 +1,7 @@
 {
    "name": "@trail-image/blog",
    "description": "Trail Image blog",
-   "version": "4.0.2",
+   "version": "4.1.0",
    "private": false,
    "author": {
       "name": "Jason Abbott"

src/app.ts

@@ -8,7 +8,7 @@ import { postProvider } from '@trailimage/flickr-provider';
 import { mapProvider } from '@trailimage/google-provider';
 import { config as modelConfig, blog } from '@trailimage/models';
 import { config } from './config';
-import { Layout, addTemplateMethods } from './views/';
+import { Layout, addTemplateMethods, requireSSL } from './views/';
 import { route } from './routes';
 
 const root = path.join(__dirname, '..');
@@ -47,6 +47,9 @@ async function createWebService() {
       app.listen(port);
       log.info(`Listening for authentication on port ${port}`);
    } else {
+      if (config.requireSSL) {
+         app.use(requireSSL);
+      }
       app.use(blockSpamReferers);
       // https://github.com/expressjs/compression/blob/master/README.md
       app.use(compress());

src/config/index.ts

@@ -23,6 +23,8 @@ export const posts = {
 export const config = {
    env,
    domain,
+   /** Whether to redirect `HTTP` requests to `HTTPS`. */
+   requireSSL: env('REQUIRE_SSL', '') == 'true',
 
    /** Whether any provider needs authorization tokens */
    //    get needsAuth(): boolean {

src/views/index.ts

@@ -1,2 +1,3 @@
 export { Page, Layout, addTemplateMethods } from './template';
 export { view, Renderer } from './view';
+export { requireSSL } from './require-ssl';

src/views/require-ssl.ts

@@ -0,0 +1,18 @@
+import { HttpStatus } from '@toba/tools';
+import { Request, Response, NextFunction } from 'express';
+
+/**
+ * Middleware to require an SSL connection.
+ */
+export function requireSSL(req: Request, res: Response, next: NextFunction) {
+   if (req.secure) {
+      next();
+   } else if (req.method == 'GET' || req.method == 'HEAD') {
+      res.redirect(
+         HttpStatus.TempRedirect,
+         'https://' + req.header('Host') + req.originalUrl
+      );
+   } else {
+      res.status(HttpStatus.Forbidden).send('Data must be submitted securely');
+   }
+}