Express.js强制HTTPS/SSL重定向错误:重定向太多

Question

所以堆栈是这样的:Express和Angular部署到Heroku.我正在尝试通过使用下面突出显示的代码的简单重定向来强制通过HTTPS提供应用程序.但是,当我在浏览器中打开URL时,出现"重定向太多"的错误.

当我输入http:// [myurl] .com时,我可以看到浏览器中的URL更改为https:// [myurl] .com,但该地址没有显示任何内容.它只是显示"太多重定向".这证明它成功地重定向但我觉得Angular搞砸了它.

当我删除下面的重定向代码并在浏览器中手动访问HTTPS或HTTP地址时,它可以正常工作.

//HTTPS redirect middleware
function ensureSecure(req, res, next) {
    console.log(req.protocol + process.env.PORT + '' + req.hostname + req.url);
    if(req.secure || req.hostname=='localhost'){
        //Secure request, continue to next middleware
        next();
    }else{
        res.redirect('https://' + req.hostname + req.url);
        console.log(req.protocol + process.env.PORT + '' + req.hostname + req.url);
    }
}
//Parse the body of the request as a JSON object, part of the middleware stack (https://www.npmjs.com/package/body-parser#bodyparserjsonoptions)
app.use(bodyParser.json());
//Serve static Angular JS assets from distribution, part of the middleware stack, but only through HTTPS
app.all('*', ensureSecure);
app.use('/', express.static('dist'));
//Import routes
app.use('/api', [router_getToken, router_invokeBhApi]);
//Setup port for access
app.listen(process.env.PORT || 3000, function () {
    console.log(`The server is running on port ${process.env.PORT || 3000}!`);
});

当您访问http:// [myurl] .com(我屏蔽了URL)时,这是heroku日志的示例:

2016-11-29T21:50:34.363391+00:00 app[web.1]: 0|app      | http37436[something].com/
2016-11-29T21:50:34.363468+00:00 app[web.1]: 0|app      | http37436[something].com/
2016-11-29T21:50:34.402022+00:00 app[web.1]: 0|app      | http37436[something].com/
2016-11-29T21:50:34.402091+00:00 app[web.1]: 0|app      | http37436[something].com/
2016-11-29T21:50:34.436006+00:00 app[web.1]: 0|app      | http37436[something].com/
2016-11-29T21:50:34.437454+00:00 app[web.1]: 0|app      | http37436[something].com/
2016-11-29T21:50:34.479580+00:00 app[web.1]: 0|app      | http37436[something].com/

浏览器(Chrome最新版)会在"网络"标签中反复显示这些请求:
"请求网址:https:// [myurl] .com /
请求方法:获取
状态代码:302找到"

请注意Heroku(express.js代码中的console.log)如何显示我正在发出HTTP请求,但我的浏览器说我正在发出HTTPS请求.如此迷茫!

编辑:我也试过这个

//HTTPS redirect middleware
function ensureSecure(req, res, next) {
    console.log(req.protocol + process.env.PORT + '' + req.hostname + req.url);
    if (req.secure || req.hostname == 'localhost') {
        //Serve Angular App
        express.static('dist');
    } else {
        //res.redirect('https://' + req.hostname + ':' + process.env.PORT + req.url);
        res.redirect('https://[myurl].com/');
    }
}
//Parse the body of the request as a JSON object, part of the middleware stack (https://www.npmjs.com/package/body-parser#bodyparserjsonoptions)
app.use(bodyParser.json());
//Serve static Angular JS assets from distribution, part of the middleware stack, but only through HTTPS
app.use('/', ensureSecure);
//Import routes
app.use('/api', [router_getToken, router_invokeBhApi]);
//Setup port for access
app.listen(process.env.PORT || 3000, function () {
    console.log(`The server is running on port ${process.env.PORT || 3000}!`);
});

Answer 1

找到了解决方案!

上下文:Heroku将源协议存储在名为"X-Forwarded-Proto"的头变量中.Heroku中的HTTP路由您需要检查此变量,而不是与Express中的'req'对象关联的协议变量.(也就是说,不要检查req.protocol,请检查req.get('X-Forwarded-Proto'))

码:

//HTTPS redirect middleware
function ensureSecure(req, res, next) {
    //Heroku stores the origin protocol in a header variable. The app itself is isolated within the dyno and all request objects have an HTTP protocol.
    if (req.get('X-Forwarded-Proto')=='https' || req.hostname == 'localhost') {
        //Serve Angular App by passing control to the next middleware
        next();
    } else if(req.get('X-Forwarded-Proto')!='https' && req.get('X-Forwarded-Port')!='443'){
        //Redirect if not HTTP with original request URL
        res.redirect('https://' + req.hostname + req.url);
    }
}