From 17914586f4108775c7baa4f16de50fae050bc3e4 Mon Sep 17 00:00:00 2001
From: Tyler Renelle <tylerrenelle@gmail.com>
Date: Thu, 11 Oct 2012 16:22:19 -0400
Subject: [PATCH] Force ssl (just a redirect, depends on x-forwarded-proto via
 heroku's ngnix

---
 lib/server/index.js     | 8 ++++++++
 src/server/index.coffee | 7 +++++++
 2 files changed, 15 insertions(+)

diff --git a/lib/server/index.js b/lib/server/index.js
index 6a0a1c6bea..bbb684f2ab 100644
--- a/lib/server/index.js
+++ b/lib/server/index.js
@@ -36,6 +36,14 @@ server = http.createServer(expressApp);
 
 module.exports = server;
 
+if (process.env.NODE_ENV !== 'production') {
+  expressApp.all('*', function(req, res, next) {
+    if (req.headers['x-forwarded-proto'] !== 'https') {
+      return res.redirect('https://' + req.headers.host + req.url);
+    }
+  });
+}
+
 derby.use(require('racer-db-mongo'));
 
 store = derby.createStore({
diff --git a/src/server/index.coffee b/src/server/index.coffee
index d4b66aa94b..01c53ad6ea 100644
--- a/src/server/index.coffee
+++ b/src/server/index.coffee
@@ -23,6 +23,13 @@ expressApp = express()
 server = http.createServer expressApp
 module.exports = server
 
+# Force SSL 
+# Set before other routes, as early as possible
+if process.env.NODE_ENV!='production'
+  expressApp.all '*', (req, res, next) ->
+    if req.headers['x-forwarded-proto']!='https'
+      res.redirect('https://'+req.headers.host+req.url)
+
 derby.use(require 'racer-db-mongo')
 store = derby.createStore
   db: {type: 'Mongo', uri: process.env.NODE_DB_URI}