force-secure-express - npm Package Compare versions

Comparing version 1.0.0 to 1.0.1

package.json

 {
   "name": "force-secure-express",
-  "version": "1.0.0",
-  "description": "",
+  "version": "1.0.1",
+  "description": "Express middleware to redirect insecure http requests to https.",
   "main": "index.js",
   "scripts": {
-    "test": "jest ./src"
+    "test": "jest ./src && codecov"
   },
-  "keywords": [],
-  "author": "",
+  "jest": {
+    "coverageDirectory": "./coverage/",
+    "collectCoverage": true,
+    "coverageThreshold": {
+      "global": {
+        "branches": 95,
+        "functions": 95,
+        "lines": 95,
+        "statements": 95
+      }
+    }
+  },
+  "keywords": [
+    "redirect",
+    "express",
+    "ssl",
+    "middleware",
+    "https",
+    "http"
+  ],
+  "author": "Ryan P. Hansen",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/rphansen91/force-secure-express"
+  },
   "license": "ISC",
   "devDependencies": {
+    "codecov": "^3.1.0",
     "jest": "^23.6.0"
   }
 }

src/get.js

@@ -0,3 +1,7 @@
+const isString = require("./isString");
+
 module.exports = function (obj, str) {
-    return (str || "")
+    if (!isString(str)) return obj
+
+    return str
     .split(".")
@@ -4,0 +8,0 @@ .reduce((p, c) => {

src/get.test.js

 const get = require("./get");
 
 describe("Get nested value", () => {
+    test("Empty", () => {
+        const obj = { a: { b: 1 } }
+        expect(get(obj)).toBe(obj)
+    })
+
+    test("Return object if path is not a string", () => {
+        const obj = { a: { b: 1 } }
+        expect(get(obj, 2)).toBe(obj)
+    })
+
     test("a", () => {
@@ -5,0 +15,0 @@ expect(get({ a: { b: 1 } }, "a")).toEqual({ b: 1 })

src/index.js

@@ -12,3 +12,3 @@ const createWhitelist = require("./whitelist");
     function isMatch (req) {
-        const { host } = req.headers || {};
+        const host = getHost(req);
         if (!hosts) return true; // Force every url to be https
@@ -20,3 +20,3 @@ return whitelist[host];
         if (!isSecure(req) && isMatch(req)) {
-            res.redirect(`https://${req.headers.host}${req.url}`);
+            res.redirect(`https://${getHost(req)}${req.url}`);
             return;
@@ -23,0 +23,0 @@ }

src/index.test.js

@@ -25,3 +25,3 @@ const forceSecure = require("./")
 
-    test("Should redirect to http", () => {
+    test("Should redirect to https", () => {
         req.url = "/a"
@@ -34,2 +34,18 @@ headers["host"] = "example.com"
 
+    test("Should not redirect to https if not whitelisted", () => {
+        req.url = "/a"
+        headers["host"] = "localhost:8000"
+        headers["x-forwarded-proto"] = "http";
+        forceSecure("example.com")(req, res, next);
+        expect(next).toBeCalled();
+    })
+
+    test("Should redirect whitelisted to https", () => {
+        req.url = "/a"
+        headers["host"] = "example.com"
+        headers["x-forwarded-proto"] = "http";
+        forceSecure("example.com")(req, res, next);
+        expect(redirect).toBeCalledWith("https://example.com/a");
+    })
+
 })

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

No README

Quality

Package does not have a README. This may indicate a failed publish or a low quality package.

Found 1 instance in 1 package

No contributors or author data

Maintenance

Package does not specify a list of contributors or an author in package.json.

Found 1 instance in 1 package

No repository

Supply chain risk

Package does not have a linked source code repository. Without this field, a package will have no reference to the location of the source code use to generate the package.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

6875

66.79%

Number of package files

14

27.27%

Lines of code

140

20.69%

Number of low maintenance alerts

2

-33.33%

Number of medium quality alerts

1

-50%

Number of lines in readme file

39

Infinity%

Number of low supply chain risk alerts

1

-50%

Worsened metrics

Dev dependency count

2

100%

No dependency changes