express-force-https is an Express.js middleware designed to automatically redirect all incoming HTTP requests to their HTTPS equivalent. First published over a decade ago, its current (and only) stable version is 1.0.0. The middleware specifically checks if a request is already secure; if not, it issues a redirect. A key feature is its built-in exemption for `localhost` requests, preventing redirects during local development. Due to its age and lack of updates, it is considered abandoned and may not be suitable for modern Express applications, especially those deployed behind reverse proxies or load balancers which require specific `X-Forwarded-Proto` header handling. Alternative, more actively maintained solutions are generally recommended for production environments.
Install & Compatibility
Where this runs
tested against v? · npm install
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslnode 18–226 runs
build_error
glibcnode 18–226 runs
build_error
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
This package is CommonJS-only and does not support ES module imports.
const secure = require('express-force-https');
Demonstrates how to integrate the express-force-https middleware into a basic Express application to enforce HTTPS redirects for all routes, excluding localhost.
const express = require('express');
const forceHttps = require('express-force-https');
const app = express();
// Use the forceHttps middleware.
// It should typically be one of the first middlewares to ensure all traffic is secured early.
app.use(forceHttps);
app.get('/', (req, res) => {
res.send('Hello from the Express server! This page should be served over HTTPS.');
});
app.get('/unsecure-test', (req, res) => {
res.send('You tried to access this via HTTP, but were redirected to HTTPS!');
});
const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
console.log(`HTTP server running on port ${PORT}. Try visiting http://localhost:${PORT}`);
console.log('You should be redirected to HTTPS if not on localhost and server is configured for SSL.');
});
// Note: This middleware only handles the redirect.
// You still need to set up an HTTPS server (e.g., with `https` module)
// or a reverse proxy (like Nginx) to handle incoming HTTPS requests.
Upgrade
Version history
Breaking-change detection hasn't run for this library yet.
Audit
Security & dependencies
CVE tracking and dependency tree are planned for a later release.