app/helpers/forceSSL.js

@@ -0,0 +1,25 @@
+/**
+ * Force load with https on production environment
+ * https://devcenter.heroku.com/articles/http-routing#heroku-headers
+ */
+module.exports = function(environments, status) {
+  environments = environments || ["production"];
+  status = status || 301;
+  console.log("New force SSL ");
+  console.log("\tenvs : ", environments);
+  console.log("\tstatus: ", status);
+  console.log("\tENV : ", process.env.NODE_ENV);
+  return function(req, res, next) {
+    if (environments.indexOf(process.env.NODE_ENV) >= 0) {
+      if (req.headers["x-forwarded-proto"] !== "https") {
+        const urlToRedirectTo = `https://${req.hostname}${req.originalUrl}`;
+        console.log("\tRedirect :", urlToRedirectTo);
+        res.redirect(status, urlToRedirectTo);
+      } else {
+        next();
+      }
+    } else {
+      next();
+    }
+  };
+};

index.js

@@ -3,6 +3,7 @@ const path = require("path");
 const bodyParser = require("body-parser");
 const layout = require("express-layout");
 const compression = require("compression");
+const forceSSL = require("./app/helpers/forceSSL");
 
 const {
   APP_PORT,
@@ -17,6 +18,7 @@ const {
 
 const app = express();
 
+app.use(forceSSL());
 app.use(bodyParser.json());
 app.use(bodyParser.urlencoded({ extended: true }));