How to transfer a webapp to https from the cloudflare?

user_12412154 0
Viewed 67

It was not in my plans to install the server as nginx, so my web application is launched on the node.js server. There, similar constructions are used to refer to certain pages:

on server:

if(process.env.NODE_ENV === 'production') {
    app.use('/', express.static(path.join(__dirname, '../', 'client', 'dist')))
}
app.use('/api/bonds', bonds);
const port = 80;

on client:

const url = '1.2.3.4:80/api/bonds';
class BondsService {
    static getBonds() {
        return new Promise(async (resolve, reject) => {
            try {
                const res = await axios.get(url);
                const data = res.data;
                resolve(data.map(bond => ({
                    ...bond
                })));
            } catch (e) {
                reject(e);
            }
        })
    }

I transferred my domain to cloudflare, and set the free SSL certificate to flexible mode. When I access the application through http, everything works, but when does the http give such an error:

xhr.js:178 Mixed Content: The page at 'https://example.com/' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://1.2.3.4/api/bonds'. This request has been blocked; the content must be served over HTTPS.

How can you fix it?

cloudflare https ssl javascript
1 Answers

We had an extensive(an hour long) discussion in the chat and I dont know how to refer the chat here entirely.So i am just posting the solution which can help you go in the right direction:

If you are part of organisation then you first have to check with Cloudflare team or whoever is the contact person from infra

  1. Connection between browser and cloudfare is https or not ? if its already https then does the CA certificate is already part of the browser/system or do we need to explicitly load it.
  2. What about the connection between cloudflare and node.js server - is it encrypted or not...if it is encrypted then you also have to load the certificates of node.js server or cloudflare server's certificates into each other's trust store. This will depend on whether it is mutual TLS or not. If it is going to be http traffic between cloudfare and node.js server then no certificates required.

Please get more understanding on https/SSL handshake process to get more clarity.

user_129062460
Related