title: HTTPS redirection for all routes node.js/express - Security concerns
body: <p>I recently took a stab at setting up HTTPS on a node/express server. I have successfully managed to redirect all the routes to use https using the code below:</p>
  
  <pre><code>// force https redirect
  var https_redirect = function(req, res, next) {
    if (req.secure) {
      if(env === 'development') {
        return res.redirect('https://localhost:3000' + req.url);
      } else {
        return res.redirect('https://' + req.headers.host + req.url);
      }
    } else {
      return next();
    }
  };
  
  app.get('*', function(req, res, next) {
    https_redirect(req, res, next);
  });
  </code></pre>
  
  <p>This seems to be working fine. However, since I havent' dabbled into this before I have a couple of questions:</p>
  
  <ol>
  <li>Is this the ideal way to redirect from http to https?</li>
  <li>If a user uses the http route, prior to the redirect is it possible for anyone to use something like sslstrip to sniff out session info.</li>
  </ol>
  
  <p>node: v0.8.2 ; express: v3.05</p>