ExpressJS 节点 HTTPS 服务器上的 Heroku 错误 H13 [英] Heroku Error H13 on ExpressJS Node HTTPS Server

问题描述

我正在尝试在我的 Node.js 服务器(Expressjs 框架)上实现 HTTPS.我有我的签名证书和密钥，以及用于测试/开发的自签名证书/密钥:

I'm trying to implement HTTPS on my Node.js server (Expressjs framework). I have my signed certificate and key, as well as a self-signed cert/key for testing/development:

if(process.env.NODE_ENV == 'production'){
  var app = module.exports = express.createServer({
    key: fs.readFileSync('./ssl/nopass_server.key'),
    cert: fs.readFileSync('./ssl/server.crt')
  });
} else {
  var app = module.exports = express.createServer({
    key: fs.readFileSync('./ssl/self_signed/nopass_server.key'),
    cert: fs.readFileSync('./ssl/self_signed/server.crt')
  });
}

我还在 Heroku 上设置了 SSL 端点.在 localhost 上一切正常，并且 Endpoint 似乎工作正常，但是当我在生产环境中(在 Heroku 上)运行该应用程序时，出现 H13 应用程序错误.有趣的是(或不)，如果我告诉 express 创建一个 HTTP 服务器: var app = module.exports = express.createServer() 它可以工作，但是 Chrome 会抱怨 https 的页面://mydomain.com 从 http://mydomain.com 运行不安全的内容.

I've also setup SSL Endpoint on Heroku. Everything works fine on localhost, and Endpoint seems to be working properly, but when I run the app in production (on Heroku) I get an H13 application error. Interestingly (or not) if I tell express to create an HTTP server instead: var app = module.exports = express.createServer() it works, but then Chrome complains that the page at https://mydomain.com ran insecure content from http://mydomain.com.

我可以不/不应该在 Express 中创建用于生产的 HTTPS 服务器吗?如果我应该这样做，是否需要额外的东西才能让它在 Heroku 上工作(例如，我相信它会使用 var port = process.env.PORT 设置正确的端口)?如果没有，如果没有运行 https 服务器，我如何提供安全"内容以便浏览器不会抱怨?

Can I not/should I not be creating an HTTPS server in express for production? If I should, is there something extra I need to make it work on Heroku (e.g. I'm trusting it to set the correct port with var port = process.env.PORT)? If not, how can I serve "secure" content if its not running an https server so browsers won't complain?

我使用以下方法处理任何非 https 请求:

I'm using the following to take care of any non-https requests:

app.get('*',function(req,res,next){
  if(req.headers['x-forwarded-proto'] != 'https'){
    res.redirect('https://mydomain.com'+req.url);
  } else next();
});

它目前位于我其余路线的正上方，这可能是问题所在/应该是其他地方吗?

This is currently located just above the rest of my routes, could this be the issue/should this be somewhere else?

我对 https 的总体经验非常有限，所以我可能遗漏了一些明显的东西.

I have very limited experience with https in general so I'm probably missing something obvious.

推荐答案

SSL 终止发生在 Heroku 的负载均衡器上；他们发送您的应用程序纯(非 SSL)流量，因此您的应用程序应该创建一个非 HTTPS 服务器.至于 https://mydomain.com 的页面运行来自 http://mydomain.com 的不安全内容，请确保所有图像/脚本/等.您的页面使用的也是通过 https 协议提供的.

SSL termination occurs at Heroku's load balancers; they send your app plain (non-SSL) traffic, so your app should create a non-HTTPS server. As for the page at https://mydomain.com ran insecure content from http://mydomain.com, make sure that all the images/scripts/etc. your page is using is also served over the https protocol.

这篇关于ExpressJS 节点 HTTPS 服务器上的 Heroku 错误 H13的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！