app/lib/https-redirect.mjs

Functions

Imports

It imports no other module of this repo. Imported by app/lib/publications/pdf-redirect.mjs, workers/app.ts.

Source

1/*
2 * HSTS is ignored over plaintext (RFC 6797 section 7.2), so this redirect is what
3 * protects a first visit. It cannot fix a plaintext cache HIT: the edge cache
4 * runs before the Worker and the scheme is not in its key ("Always Use HTTPS" at
5 * the zone can). For the same reason the redirect must never be cached, or HTTPS
6 * readers would be redirected to the URL they asked for: a loop.
7 */
8
9/** The dev server and wrangler serve plaintext; redirecting them breaks local dev. */
10const LOOPBACK = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
11
12/**
13 * @param {string} requestUrl
14 * @returns {string | null}
15 */
16export function httpsRedirectTarget(requestUrl) {
17  let url;
18  try {
19    url = new URL(requestUrl);
20  } catch {
21    return null;
22  }
23
24  if (url.protocol !== "http:") return null;
25  if (LOOPBACK.has(url.hostname)) return null;
26  if (url.hostname.endsWith(".localhost")) return null;
27
28  url.protocol = "https:";
29  return url.toString();
30}
31
32/**
33 * 308 for non-GET: a 301 lets a browser turn a POST into a GET and drop the
34 * no-script sign-in form's body. Every redirect the gateway answers uses this rule; the post and
35 * PDF helpers re-export it under their own names.
36 *
37 * @param {string} method
38 * @returns {number}
39 */
40export function httpsRedirectStatus(method) {
41  const m = String(method ?? "").toUpperCase();
42  return m === "GET" || m === "HEAD" ? 301 : 308;
43}