Force ssl (just a redirect, depends on x-forwarded-proto via heroku's ngnix

lib/server/index.js

@@ -36,6 +36,14 @@ server = http.createServer(expressApp);
 
 module.exports = server;
 
+if (process.env.NODE_ENV !== 'production') {
+  expressApp.all('*', function(req, res, next) {
+    if (req.headers['x-forwarded-proto'] !== 'https') {
+      return res.redirect('https://' + req.headers.host + req.url);
+    }
+  });
+}
+
 derby.use(require('racer-db-mongo'));
 
 store = derby.createStore({

src/server/index.coffee

@@ -23,6 +23,13 @@ expressApp = express()
 server = http.createServer expressApp
 module.exports = server
 
+# Force SSL 
+# Set before other routes, as early as possible
+if process.env.NODE_ENV!='production'
+  expressApp.all '*', (req, res, next) ->
+    if req.headers['x-forwarded-proto']!='https'
+      res.redirect('https://'+req.headers.host+req.url)
+
 derby.use(require 'racer-db-mongo')
 store = derby.createStore
   db: {type: 'Mongo', uri: process.env.NODE_DB_URI}