Registry / security / express-force-https-schema

express-force-https-schema

library1.0.3jsnpmunverified

Configurable Express middleware that forces HTTPS based on the X-Forwarded-Proto header, commonly used behind proxies like Heroku, AWS ELB, and Nginx. Version 1.0.3 is the latest stable release (last updated 2018, in maintenance mode). It uses a header-based check rather than direct protocol detection, making it suitable for load-balanced or containerized environments. Unlike similar middleware (e.g., express-sslify), it provides options to skip certain user agents and disable the check via an enabled flag.

security devops

npm install express-force-https-schema

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · EXPRESS-FORCE-HTTP

express-force-https-schema

securityjavascriptv1.0.3

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

default

✓ import forceHttpsSchema from 'express-force-https-schema'

✗ const forceHttpsSchema = require('express-force-https-schema')

The package ships as an ESM default export. CommonJS users must use the default import pattern or check compatibility.

Express middleware function

✓ app.use(forceHttpsSchema({ enabled: true }))

✗ app.use(new forceHttpsSchema())

The import returns a function that returns middleware. Do not instantiate with 'new'.

Configuration object type (TypeScript)

✓ import type { Options } from 'express-force-https-schema'

✗ import { Options } from 'express-force-https-schema'

TypeScript types may not be bundled; check DefinitelyTyped or use a separate .d.ts file.

Minimal Express app with HTTPS redirection middleware using X-Forwarded-Proto header, skipping health checks.

import express from 'express'; import forceHttpsSchema from 'express-force-https-schema'; const app = express(); app.use( forceHttpsSchema({ enabled: process.env.FORCE_HTTPS === 'true', skipUserAgents: /ELB-HealthChecker/i }) ); app.get('/', (req, res) => { res.send('Hello HTTPS!'); }); app.listen(3000);

Debug

Known issues

gotchaThe middleware does not handle redirection with query strings preserved.

fix

Manually append the original query string from req.url after redirection, or use middleware like express-sslify which handles this.

affects: >=1.0.0

deprecatedPackage last updated in 2018; no active maintenance. May not support Express 4.x or later versions fully.

fix

Consider migrating to express-sslify or a custom middleware if security updates are needed.

affects: >=1.0.0

gotchaIf the X-Forwarded-Proto header is missing or set incorrectly, requests may not redirect as expected.

fix

Ensure your reverse proxy (e.g., Nginx, AWS ELB) sets the header correctly. For local development, set a test header or disable the middleware.

affects: >=1.0.0

Errors

Common errors & fixes

TypeError: forceHttpsSchema is not a function

CommonJS require returns an object with default property instead of the function directly.

fix

Use import forceHttpsSchema from 'express-force-https-schema' or const forceHttpsSchema = require('express-force-https-schema').default

Redirect loop with infinite redirects

The proxy sets X-Forwarded-Proto as 'http' even after redirect, or the middleware does not check the final host.

fix

Verify proxy configuration (e.g., set X-Forwarded-Proto to https) and ensure the middleware is only applied to non-HTTPS requests.

Upgrade

Version history

1.0.3latest on npm

Audit

Dependencies

expressrequiredpeer dependency; required as middleware for Express applications

Agent activity

18 hits · last 30 days

node

Amazon

OpenAI (training)

Resources

githubssh://git@github.com/kilhage/express-force-https-schema ↗

packageexpress-force-https-schema ↗

homepagehttps://github.com/kilhage/express-force-https-schema#readme ↗