I'm not asking how to force HTTPS, I'm asking why in Azure deployment is
falseeven when the request is over HTTPS.
Here's why [click to embiggen]:
The Azure App Service Frontend layer TERMINATES the TLS channel (aka TLS offloading) and opens a new plain HTTP connection to your Web Worker, where your code lives. Routing is performed by ARR (Application Request Routing).
(View slides, Slide 12)
Therefore, from the point of view of your code every single request is "insecure".
X-Forwarded-Proto=https hints about the original request (that hit the Frontends). Although i'm not entirely sure who adds that in.
If checks have to be made, i'd make them against
ARR is attaching a special request header to every request that arrives over HTTPS. The value contained in
X-ARR-SSL provides information about the TLS server certificate that was used to secure the TCP connection between the client and the ARR.
X-ARR-SSL: 2048|256|C=US, S=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT SSL SHA2|CN=*.azurewebsites.net
A whole more info around that here:
(Tomasz is the author of the iisnode project, which is the mechanism for running Node applications in Azure App Service.)