I'm building a stateless authentication by Double Submit Cookie in Node.js/ExpressJs and wonder how I best can make all my connections go over HTTPS.
The reason is that I want to be able to handle high traffic and only use HTTPS for security reasons with the stateless authentication.
Should I avoid the HTTPS npm dependency and set up a reverse proxy server in Nginx?
Perhaps I can configure Nginx so that it will enforce HTTPS without doing any other in-app settings in ExpressJs?
You have two options:
https module that comes with Node.js (not an npm module). This will handle the HTTPS requests. Good for light applications, personal web sites, development.http module). The proxy will terminate SSL from an incoming HTTPS request, then proxy a plain HTTP request to your Web server. Good for production, high traffic applications that also need load balancing provided by these proxy software.For playing around, I suggest going simple with the built-in https module. I suppose you do not expect millions of requests to introduce a proxy to your stack.