Force SSL for Express app on Heroku

gistfile1.js

// ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
// Hooking up the middleware with the express app
// In app.js
// ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

var forceSSL = require('../middleware/ssl').force(config.hostname);
if ('production' == app.get('env')) {
  app.use(forceSSL);
}

// ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
// Middleware
// In middleware/ssl.js
// ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

var redirectUrl = exports.redirectUrl = function(protocol, hostname, url) {
  return protocol === 'https' ? null : ('https://' + hostname + url);
};

exports.force = function(hostname) {
  return function(req, res, next) {
    var redirectTo = redirectUrl(req.header('X-Forwarded-Proto'), hostname, req.url);
    if (redirectTo) {
      res.redirect(301, redirectTo);
    } else {
      next();
    }
  };
};

// ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
// Mocha test
// In test/middleware/ssl_test.js
// ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

var _ = require('lodash'),
  assert = require('assert'),
  sinon = require('sinon'),
  ssl = require('../../lib/middleware/ssl');

describe('middleware/ssl', function() {
  describe('redirectUrl', function() {
    it('returns an https url if protocol is http', function() {
      assert.equal('https://api.naturkartan.se/some/url', ssl.redirectUrl('http', 'api.naturkartan.se', '/some/url'));
    });

    it('returns null if protocol is https', function() {
      assert.equal(null, ssl.redirectUrl('https', 'api.naturkartan.se', '/some/url'));
    });
  });

  describe('force', function() {
    it('calls next if request is secure', function() {
      var req = {header: sinon.stub().withArgs('X-Forwarded-Proto').returns('https')},
          res = {},
          next = sinon.mock().once();

      ssl.force('api.naturkartan.se')(req, res, next);

      next.verify();
    });

    it('redirects to https if request is not secure', function() {
      var req = {url: '/foobar', header: sinon.stub().withArgs('X-Forwarded-Proto').returns('http')},
          res = {redirect: sinon.mock().withArgs(301, 'https://api.naturkartan.se/foobar').once()},
          next = {};

      ssl.force('api.naturkartan.se')(req, res, next);

      res.redirect.verify();
    });
  });
});