title: Express redirect is unreliable, is there caching?
body: <p>I am using nodejs and express to redirect all http requests to https. Usually the browser is successfully redirected to https but its often possible to type in an url with http (or without any protocol) that appears not to redirect: the page loads but the url bar stays as mysite.com without https or a lock icon.</p>
  
  <p>This can happen in both Chrome and IE. When this happens, the Chrome network logger shows a mixture of 304 and 302 responses. Does this mean that there is some sort of caching causing the browser to not redirect to https?</p>
  
  <pre><code>   var express = require('express'),
          path = require('path'),
          http = require('http'),
          https = require('https'),
          fs = require ('fs');
  
      var app = express();
  
      var options = {
        key: fs.readFileSync('cert/rsa.key'),
        cert: fs.readFileSync('cert/rsa.crt'),
        ca: fs.readFileSync('cert/sub.class1.server.ca.pem')
      };
  
      function requireHTTPS(req, res, next) {
          if (!req.secure) {
              return res.redirect('https://' + req.get('host') + req.url);
          }
          next();
      }
  
      app.use(requireHTTPS);
  
      app.use('/path/html', express.static(rootFolder + 'path/html'));
      app.use('/path/fonts', express.static(rootFolder + 'path/fonts'));
  
      app.all('*', function (req, res) {
          res.sendfile('index.html', { root: rootFolder + 'path/' });
      })
  
      https.createServer(options, app).listen(443);
      http.createServer(app).listen(80);
  </code></pre>
  
  <p>Edit - tips for reproducing</p>
  
  <p>I am using the recommended https redirect method for express so I suspect many sites suffer from this problem without realising it. For Chrome on W7, I always see a correct redirect on first visit or when I use the url auto-complete or the omnibox drop down. However if I type in the url or hand edit an auto-complete, then I can reliably see a failed redirect:</p>
  
  <ol>
  <li><p>Delete chrome browser cache</p></li>
  <li><p>type in your url <code>http://_mysite.com</code> and hit enter 
  => correct redirect to <code>https://_mysite.com</code></p></li>
  <li><p>create a new tab, type your url until it auto-completes and hit enter
  => correct redirect to <code>https://_mysite.com</code></p></li>
  <li><p>create a new tab, as 3. but before hitting enter, edit the auto-complete by deleting the last character and retyping, hit enter 
  => page renders but url stays at <code>http://_mysite.com</code> with no lock symbol. </p></li>
  </ol>
  
  <p>Server logs show the root static page is not fetched, only some parts of the page content. All get requests to the page content are https despite the browser not reporting this.</p>