redirect HTTP to HTTPS unless explicitly instructed not to do this redirection

README.md

@@ -265,6 +265,7 @@ To learn more about the Nightscout API, visit https://YOUR-SITE.com/api-docs.htm
   * `SHOW_RAWBG` (`never`) - possible values `always`, `never` or `noise`
   * `CUSTOM_TITLE` (`Nightscout`) - Usually name of T1
   * `THEME` (`default`) - possible values `default`, `colors`, or `colorblindfriendly`
+  * `INSECURE_USE_HTTP` (`false`) - possible values `false`, or `true`. 
   * `ALARM_TIMEAGO_WARN` (`on`) - possible values `on` or `off`
   * `ALARM_TIMEAGO_WARN_MINS` (`15`) - minutes since the last reading to trigger a warning
   * `ALARM_TIMEAGO_URGENT` (`on`) - possible values `on` or `off`

app.js

@@ -14,6 +14,14 @@ function create(env, ctx) {
     var appInfo = env.name + ' ' + env.version;
     app.set('title', appInfo);
     app.enable('trust proxy'); // Allows req.secure test on heroku https connections.
+    if (process.env.INSECURE_USE_HTTP !== 'true') {
+        app.use((req, res, next) => {
+        if (req.header('x-forwarded-proto') !== 'https')
+            res.redirect(`https://${req.header('host')}${req.url}`)
+        else
+            next()
+        })
+     }
 
     app.set('view engine', 'ejs');
     // this allows you to render .html files as templates in addition to .ejs
@@ -208,4 +216,4 @@ function create(env, ctx) {
     //}
     return app;
 }
-module.exports = create;
+module.exports = create;