restify / restify/node-restify

Marking the server as secure when only using httpsServerOptions

Open
#1,605 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Critical
Dominant language
JavaScript
Stars
10.7k
Forks
975
Avg merge
1d 6h
Merged PRs (30d)
5

Description

Bug Report

When creating a server by only using httpsServerOptions, the server is not mark as secure. This cause the subsequent listen to report using http:// instead of https://.

This doesn't affect servers created while declaring httpsServerOptions directly in the options object, only if you put them all in httpsServerOptions. Also, as far as I know, it doesn't seem to affect functionality, because clients can still connect via HTTPS and the req.isSecure() method returns true. It's only for fetching the URL from the url property of the restify server that seems to be affected.

Restify Version

6.3.4

Node.js Version

9.5.0

Expected behaviour

Should be listening on https://127.0.0.1:8443.

Actual behaviour

Is listening on http://127.0.0.1:8443.

Repro case

const restify = require('restify');

const server = restify.createServer({
    name: 'simple-server',
    version: '1.0.0',
    httpsServerOptions: {
    }
});

server.listen(8443, 'localhost', () => {
    // output => simple-server listening at http://127.0.0.1:8443
    console.log('%s listening at %s', server.name, server.url);
});

Cause

The cause is found in /lib/server.js, at line 169. When creating the HTTPS server, this.secure should be set to true.

Are you willing and able to fix this?

Yes, check this commit: https://github.com/wolfmah/node-restify/commit/9573125008a0c05bb8bf4152f2258dafd66631d9

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Inspect /lib/server.js around line 169, where the issue identifies HTTPS server creation. Run the provided restify.createServer reproduction and verify that server.url reports https://127.0.0.1:8443 after the change; confirm existing HTTPS behavior remains intact.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
api, backend
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.