‫In this lecture, we're very quickly
‫gonna learn how to test for secure https connections,
‫with a Heroku,
‫because we actually need that, at one point,
‫in our application.
‫So, let's go here to our authentication controller.
‫And right here at the top,
‫in this create sent token function,
‫here is the place where we set
‫the adjacent web cookie to secure,
‫if we are currently in production.
‫Remember that.
‫So, remember that we created this function
‫with adjacent response,
‫it also sends a cookie,
‫which also contains the adjacent web token.
‫And that cookie has a couple of options.
‫The first one, when it expires.
‫The second one,
‫that it can only be accessed via http basically.
‫And then, when we're in production,
‫we said that this cookie can only be sent
‫on a secure connection.
‫So, basically, on an https connection.
‫All right.
‫Now, the problem with that is that actually,
‫the fact that we are in production,
‫does not mean that connection is actually secure.
‫Right?
‫Because of course, not all deployed applications
‫are automatically set to https.
‫And so we need to change this if that we have here.
‫All right.
‫Now, in express we actually have a secure property
‫that is on the request.
‫And only when the connection is secure,
‫then this request dot secure is true.
‫Okay?
‫Makes sense, right?
‫Now the problem is, that actually in Heroku,
‫this doesn't work.
‫And that's because Heroku proxy's,
‫so basically redirect or modifies all incoming requests
‫into our application before they actually reach the app.
‫All right.
‫So, in order to make this also work on Heroku
‫we need to also test if the x forward proto
‫header is set to https.
‫All right.
‫So, that sounds a bit confusing,
‫but again, this is something Heroku does internally.
‫So, let's test here if req.secure is true,
‫or if req.headers.
‫And the header that we're looking for is x forwarded proto.
‫And this header is set to https
‫if we are on a secure connection.
‫All right?
‫So, this is something very Heroku specific.
‫And that's why I left this here for the last section,
‫after we already deployed the application.
‫So, if either req.secure is true,
‫or if this header here is set to https,
‫then we want the secure options here set to true.
‫And, so, we can actually refactor this.
‫So, basically we can take this,
‫because this will be true.
‫And, so, I say if this is true,
‫then let's say equal true here.
‫So, that doesn't make sense.
‫We can instead simply do it like this.
‫All right?
‫And, actually, we can take it even further.
‫And put the secure option right here.
‫So, why have it outside if we can just put it here?
‫So, secure equals this, okay?
‫And then we no longer need this.
‫And, since we're refactoring,
‫we actually no longer need this variable here at all.
‫So, let's just put it here, give it a safe,
‫and there's something wrong there.
‫Okay, and so, now the problem is that
‫do not have access currently to the request
‫in this function.
‫Okay, so, we need to add it here.
‫Request and then wherever we have create sent token,
‫we of course need to pass in the request in there.
‫So, that's here.
‫So, use command D to find the next one basically.
‫Request here.
‫And then finally here as well.
‫Okay, so, that looks much nicer
‫and it should also work a lot nicer than before.
‫However, right now, this is still not going to be working,
‫because there's just one more thing that we need to do,
‫which is basically to make our application trust proxy's.
‫So, again, request dot secure doesn't work
‫in the first place because Heroku acts as a proxy,
‫which kind of redirects and modifies incoming requests.
‫And, so, we need to go to app dot JS
‫and then right after this one here,
‫let's now trust proxy's.
‫And we do that by saying app dot enable trust proxy.
‫Okay?
‫So, this is something that is built into express
‫for this kind of situations.
‫All right?
‫And so, only if we have this setting here correctly set up,
‫then this header here will be correctly set,
‫and we will be able to read its value.
‫All right?
‫So, this is how you test if a connection is secure or not,
‫when you have your application deployed to Heroku.