Question

我想只允许https流量到我的Hapi Js服务器。

在这个主题中： Node.JS, Express and Heroku - how to handle HTTP and HTTPS?

它完成了：

if (process.env.NODE_ENV == 'production') {
        app.use(function (req, res, next) {
            res.setHeader('Strict-Transport-Security', 'max-age=8640000; includeSubDomains');
            if (req.headers['x-forwarded-proto'] && req.headers['x-forwarded-proto'] === "http") {
                return res.redirect(301, 'https://' + req.host + req.url);
            } else {
                return next();
            }
        });
    }

Answer 1

这是一个很好的npm模块：https://www.npmjs.org/package/hapi-require-https

Answer 2

这是我（相当hacky）的解决方案：

// redirect all http request to secure route
if ('production' === process.env.NODE_ENV) {
  server.ext('onRequest', function (request, next) {
    if (request.headers['x-forwarded-proto'] !== 'https') {
      request.originalPath = request.path;
      request.setUrl('/redirect');
    }
    next();
  });

  server.route([{
    method: 'GET',
    path: '/redirect',
    handler: function (request, reply) {
      var host = request.headers.host;
      reply().redirect('https://' + host + request.originalPath);
    }
  }]);
}

也许有人能想出更清洁的东西。警告：这不会阻止不安全的http流量。它只是将浏览器重定向到https位置。

node js Hapi js和heroku如何处理https

2 个答案: