Making requests to a node API from a different domain using HTTPS

Question

I am serving a static page over HTTPS ( https://example.com ) that makes requests to a node API on a different domain (example-api.com).

My API is a standard express app using HTTP. Here's my setup code:

var express = require('express');
var app = exports.app = express();
var port = process.env.PORT;

exports.server = require('http').createServer(app).listen(port);

In the requests from my static page, I specify https://example-api.com as the URL. This works most of the time, but every once in a while (10% of the time?) Chrome errors out on the requests with:

net::ERROR_INSECURE_RESPONSE

Other users who've come across this issue (eg Failed to load resource: net::ERR_INSECURE_RESPONSE socket.io ) seem to solve it by adding a credentials option to their createServer call, eg

var server = https.createServer(credentials, app)

So when I tried to implement this I came up with the following:

var fs = require('fs');
var options = {
  key: fs.readFileSync('server-key.pem'),
  cert: fs.readFileSync('server-cert.pem')
};
var express = require('express');
var app = exports.app = express();

exports.server = require('https').createServer(options, app).listen(port);

However this solution doesn't seem to work for me. When I try it the requests never make it to my app - even logs in app.use middleware don't appear.

What's really confusing is the fact that my setup seems to work most of the time.

Does anyone know how I can reliably make my requests?

Thanks and sorry in advance for my ignorance.

Answer 1

I struggled with this a bit as well. If you are on windows I have a solution that is a bit of a work around, but will allow you to serve your site, and NodeJS app over HTTPS.

In Windows, I created a reverse proxy in IIS to point at the nodeJS RESTful endpoint (ie nodeJS RESTful services == website.com:7000). Don't let reverse proxy scare you, its gravy.

To Implement:

1. Install IIS (if you haven't already)
2. Create your Self Signed Cert (assuming you know how to do that), or apply your Cert you are using now.
3. Install Application Request Routing
4. Open your website configuration, and go to URL Rewrite
5. For the rewrite stuff:

For Pattern: ^api(.*)

For rewrite: http://www.website.com:7000 {R:1}

This basically takes any request from: https://www.website.com/api/someApiAwesomeness , and rewrites it to your nodejs App running at http://www.website.com:7000 . Now you have an SSL RESTful app..

Good luck man I hope this helps!