Parse-dashboard: Enforce https behind proxies

[mattgoldspink]

At the moment the HTTPS check is pretty simple and doesn't account for platforms where the node app is hosted behind an ssl terminating proxy (heroku for example).

Checking the "X-Forwarded-Proto" header is a good start but as @flovilmart has mentioned, this can easily be spoofed. I'm yet to find a bulletproof solution, so open to suggestions. Here's a quick link dump I've found on what others have done for reference:

• http://stackoverflow.com/questions/7185074/heroku-nodejs-http-to-https-ssl-forced-redirect
• http://esd.io/blog/flask-apps-heroku-real-ip-spoofing.html (seems a more robust solution that takes into account the number of expected proxies)

[flovilmart]

When not running HTTPS you have the allowInsectureHTTP flag that allows you to trust the incoming request. Your heroku server should not respond to HTTP requests (or redirect them to HTTPS).

[drew-gross]

My preference would be to have the --allowInscureHTTP flag actually just enable the 'trust proxy' setting in Express. That is at least more secure than the current setup. I just want to avoid having beginners enable --allowInsecureHTTP blindly because they just want it to work.

[flovilmart]

Agreed!