enforceSsl.js

// author arcseldon@icloud.com
'use strict';

module.exports = function (req, res, next) {
  // we ARE deploying to Heroku. SSL termination happens at the load balancer,
  // before encrypted traffic reaches your node app. It is possible to test
  // whether https was used to make the request with req.headers['x-forwarded-proto'] === 'https'.
  // See SOF answer by arcseldon: http://stackoverflow.com/a/22585754/1882064
  if ((req.headers['x-forwarded-proto'] !== 'https') && (process.env.NODE_ENV === 'production')) {
    return res.redirect([
      'https://',
      req.get('Host'),
      req.url
    ].join(''));
  } else {
    next();
  }
};