Express server with http to https redirection for production.

express-server.js

const fs = require('fs');
const path = require('path');
const spdy = require('spdy');
const helmet = require('helmet');
const express = require('express');
const compression = require('compression');

const server = express();
const { NODE_ENV } = process.env;
const isDev = NODE_ENV === 'development';

// security config
server.enable('trust proxy');
server.use(compression({
  level: 9,
  memLevel: 9
}));
server.use(helmet.frameguard());
server.use(helmet.xssFilter({ setOnOldIE: true }));
server.use(helmet.hidePoweredBy());
server.use(helmet.hsts({ force: true }));
server.use(helmet.ieNoOpen());
server.use(helmet.noSniff());

if (!isDev) {
  // redirect http to https for domain
  server.use((req, res, next) => {
    const {
      protocol,
      url,
      headers: {
        host
      }
    } = req;

    if (!/https/.test(protocol)) {
      res.redirect(301, `https://${host}${url}`);
    } else {
      next();
    }
  });

  server.use(express.static(path.join(__dirname, 'build')));
  server.use(express.static(path.join(__dirname, 'static')));
  server.get('/*', (req, res) => {
    res.sendFile(path.join(__dirname, 'build', 'index.html'));
  });

  // serving hhtps port 443 through http2
  spdy.createServer({
    key: fs.readFileSync('./ssl.key'),
    cert: fs.readFileSync('./ssl.crt'),
    ca: fs.readFileSync('./ssl.pem'),
  }, server)
    .listen(8181, () => {
      console.log(`Server is running at port ${8181} for HTTPS`);
    });
}

// serving http port 80
server.listen(8080, () => {
  console.log(`Server is running at port ${8080} for HTTP`);
});