Registry / web-framework / hapi-require-https

hapi-require-https

library6.0.0jsnpmunverified

hapi-require-https is a Hapi plugin designed to enforce HTTPS for incoming requests, providing automatic HTTP to HTTPS redirection. The current stable version is 6.0.0, which requires Hapi v20 or newer. This plugin primarily operates by default using the `X-Forwarded-Proto` header, making it ideal for applications running behind a reverse proxy (like on Heroku or other PaaS environments). It offers a straightforward API, registering as an `onRequest` lifecycle hook to perform 301 redirects. A key differentiator is its explicit support for proxy environments, configurable via a `proxy` option, which can be set to `false` to redirect based on the actual request protocol instead of the forwarded header. Release cadence typically aligns with major Hapi versions or necessary compatibility updates.

web-framework auth-security

npm install hapi-require-https

github ↗package ↗

INSTALL

IMPORT

SIG · HAPI-REQUIRE-HTTPS

hapi-require-https

web-frameworkjavascriptv6.0.0

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

plugin

✓ import HapiRequireHttps from 'hapi-require-https'; // then use HapiRequireHttps in server.register

✗ import { plugin } from 'hapi-require-https';

The package exports the plugin object as its default export for direct registration with Hapi. Since v3, it is primarily ESM-compatible, though CJS `require` still works.

plugin (CommonJS)

✓ const HapiRequireHttps = require('hapi-require-https'); // then use HapiRequireHttps in server.register

✗ const { plugin } = require('hapi-require-https');

For CommonJS environments, `require()` directly returns the plugin object, which should be passed to `server.register`.

Options type

✓ import type { Options } from 'hapi-require-https';

Import the `Options` type for type-checking when configuring the plugin.

This quickstart demonstrates how to set up a basic Hapi server and register hapi-require-https, enabling automatic HTTP to HTTPS redirection. It includes a simple route to show the active protocol.

import Hapi from '@hapi/hapi'; import HapiRequireHttps from 'hapi-require-https'; const init = async () => { const server = Hapi.server({ port: 3000, host: 'localhost' }); await server.register({ plugin: HapiRequireHttps, options: { proxy: true // Default, redirects based on X-Forwarded-Proto } }); server.route({ method: 'GET', path: '/', handler: (request, h) => { return `Hello from Hapi! Protocol: ${request.server.info.protocol}. Real protocol: ${request.headers['x-forwarded-proto'] || 'unknown'}`; } }); await server.start(); console.log(`Server running on ${server.info.uri}`); }; process.on('unhandledRejection', (err) => { console.log(err); process.exit(1); }); init();

Debug

Known issues

breakinghapi-require-https v6.0.0 introduced a peer dependency on `@hapi/hapi` version `>=20`. Applications using older Hapi versions (e.g., v19 or earlier) must upgrade Hapi or use an older version of this plugin.

fix

Upgrade your Hapi server to `@hapi/hapi@^20.0.0` or higher, or downgrade `hapi-require-https` to a compatible major version (e.g., `5.x` for Hapi v19).

affects: >=6.0.0

gotchaBy default, the plugin redirects based on the `X-Forwarded-Proto` header (`options.proxy` is `true`). If your application is not behind a reverse proxy that sets this header, requests will not redirect as expected, or may redirect incorrectly.

fix

If your application is not behind a reverse proxy, set the `proxy` option to `false` when registering the plugin: `server.register({ plugin: HapiRequireHttps, options: { proxy: false } })`. This forces redirection based on the actual request protocol.

affects: >=1.0.0

breakingThe package moved towards an ESM-first approach in its distribution. While CommonJS `require()` still generally works, developers should be aware of potential import issues in mixed environments or newer Node.js versions, especially with TypeScript `moduleResolution: 'node16'` or `bundler`.

fix

Prefer `import HapiRequireHttps from 'hapi-require-https';` for new projects or when using ESM. For existing CommonJS projects, continue using `const HapiRequireHttps = require('hapi-require-https');` but monitor for future compatibility issues.

affects: >=3.0.0

Errors

Common errors & fixes

Error: Plugin `@hapi/hapi` version mismatch. `@hapi/hapi` must be `~20.0.0` but `19.1.0` was found.

The installed version of Hapi does not meet the peer dependency requirements of hapi-require-https v6.0.0.

fix

Upgrade your Hapi installation: `npm install @hapi/hapi@^20` or `yarn add @hapi/hapi@^20`. Alternatively, downgrade hapi-require-https to a version compatible with your current Hapi installation, e.g., `npm install hapi-require-https@^5`.

ERR_HTTP_HEADERS_SENT: Cannot set headers after they are sent to the client

This error typically occurs if a response has already been sent (e.g., by another plugin or route handler) before hapi-require-https attempts to issue a redirect. Ensure hapi-require-https runs early in the request lifecycle.

fix

Verify the order of plugin registration. hapi-require-https should generally be registered before other plugins that might send responses or perform complex operations that could interfere with early redirection.

Upgrade

Version history

6.0.0latest on npm

Audit

Dependencies

@hapi/hapirequiredPeer dependency; this is a Hapi plugin and requires a compatible Hapi server instance.

Agent activity

16 hits · last 30 days

node

Amazon

OpenAI (training)

Resources

githubhttps://github.com/bendrucker/hapi-require-https ↗

packagehttps://www.npmjs.com/package/hapi-require-https ↗