Use strict https headers and redirect from http to https in production mode

[frankieroberto]

This aims to avoid browser warnings if users accidentally visit a prototype in non-secure mode.

It does this by adding the Strict-Transport-Security HTTP header and Content-Security-Policy to upgrade-insecure-requests.

This will ensure that all subsequent requests will automatically use https, even if the http:// prefix is typed into the URL bar.

Additionally, the kit will automatically respond with a redirect to the https url whenever insecure requests are made.

This only happens when NODE_ENV is set to production, to avoid any issues when running the prototype over localhost

Once your prototype is running with the header set, you can also submit the domain to https://hstspreload.org/ (although this doesn't work for subdomains) which will ensure the browsers at it to their list of domains to always use https on without even having to visit it first.

Fixes #141

Checklist

• CHANGELOG entry

[frankieroberto]

@edwardhorsford @vickytnz ok to approve this?

We should then add some guidance to suggest adding the NODE_ENV=production env variable in hosting environments (Heroku, etc) - although some of them might add it by default.

[frankieroberto]

Setting NODE_ENV=production also does some performance things in Express: https://expressjs.com/th/advanced/best-practice-performance.html#set-node_env-to-production

[vickytnz]

oh wow - i didn't realise that was the case. I know that I had to do this for railway but didn't think I needed to for heroku but that does have some performance benefits

[vickytnz]

@edwardhorsford @vickytnz ok to approve this?

We should then add some guidance to suggest adding the NODE_ENV=production env variable in hosting environments (Heroku, etc) - although some of them might add it by default.

Reviewing the guidance, we already say that railway users have to do this. https://prototype-kit.service-manual.nhs.uk/how-tos/publish-your-prototype-online

In Railway, you also need to create:

a variable called NODE-ENV and set the value to production
a variable called USE_AUTH with the value of true

Unless this breaks Heroku (which I don't think it does), this should be OK to go without changes.

My only thought is that whether this makes enough of a difference to performance that we need to headline it as adding it in and saying (the prototype will run without it but it will take images slower to load and use more data)

EDIT: read your notes from the top, you're saying that it's done by default by Heroku so actually the guidance is probably good enough.

[frankieroberto]

@vickytnz yep, I believe that's the case, although we should probably test it. Can't remember if I added it manually or not.

[frankieroberto]

@anandamaryon1 could you review?

[frankieroberto]

I’ve verified this works on Heroku.

For Railway, they do their own redirecting of HTTP -> HTTPS at the proxy layer for all apps, so the code is unneeded, but doesn’t do any harm.

[colinrotherham]

Nice work, let's give it a go. Can always tweak some more