Stop 01 · Web & Internet FoundationsTopics · 2/10

HTTP vs HTTPS

Part of the Full Stack Developer Roadmap

In short

On the backend, HTTPS is your job, not the browser's. You set up the certificate, redirect plain HTTP, and make sure passwords never travel as readable text.

HTTP is the protocol clients and servers use to exchange requests and responses; HTTPS is the same protocol encrypted with TLS/SSL so data can't be intercepted in transit.

The mascot invigilator checks the seal on a question paper packet next to an open, unsealed one.

Think of it like this

Sealed question paper packets

Board exam papers travel in sealed packets. Nobody on the way can read them, and the invigilator checks the official seal before opening. HTTPS gives your API both: encryption so snoops see nothing, and a certificate that proves the data really came from you.

Watch it happen

The TLS handshake, then your API call

Client

Your server

ClientHello

1/6The client lists the TLS versions and encryption methods it supports.

The big ideas

What you need to know

TLS ends somewhere

Often a load balancer or Nginx handles HTTPS and passes plain HTTP to your Node app inside a private network.

Certificates are free

Let's Encrypt issues free certificates. They are short-lived, so set up automatic renewal instead of doing it by hand.

Redirect plain HTTP

Anyone who types http:// should get a 301 redirect to the https:// version of the same URL.

HSTS locks it in

The Strict-Transport-Security header tells browsers to use HTTPS for your domain on every future visit, even if someone types http://.

See it in code

Walk through the code

1import express from "express";2 3const app = express();4app.set("trust proxy", 1); // TLS ends at the load balancer5 6app.use((req, res, next) => {7  if (req.secure) return next();8  res.redirect(301, "https://" + req.headers.host + req.originalUrl);9});10 11app.use((req, res, next) => {12  res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains");13  next();14});

1/3trust proxy tells Express to believe the X-Forwarded-* headers set by the load balancer in front of it.

The load balancer adds an X-Forwarded-Proto header saying whether the client used HTTPS. Without trust proxy, Express ignores it and req.secure is always false.

Save yourself the pain

Common mistakes

Oops

Committing the certificate's private key (the .pem or .key file) to Git.

Do this instead

Treat it like a password. Keep it in a secret manager or on the server only, and add it to .gitignore.

Oops

Setting NODE_TLS_REJECT_UNAUTHORIZED=0 to make a certificate error go away.

Do this instead

That switches off certificate checks for every request. Fix the real problem, usually an expired cert or a missing intermediate certificate.

Your mission

Inspect a real certificate

~15 min

Quick check

Your Express app sits behind a load balancer that handles HTTPS. req.secure is always false. Why?

Go deeper

1Inspect a site's HTTPS certificate in your browser's address bar.
2Learn what the TLS handshake does at a high level.
3Understand why HTTPS is now a hard requirement for any production app.