title: PassportJS callback switch between http and https
body: <p>Right now, when I visit my page at <a href="https://example.com" rel="noreferrer">https://example.com</a> and click login, it goes to <a href="https://example.com/auth/facebook" rel="noreferrer">https://example.com/auth/facebook</a>, which then does the facebook stuff and ends up calling back <a href="http://example.com/auth/facebook/callback" rel="noreferrer">http://example.com/auth/facebook/callback</a>. I can't seem to get it to call back using the https scheme (but only when the request cycle started in https). </p>
  
  <p>right now, when viewed through an https iframe (facebook canvas app), I get the error</p>
  
  <blockquote>
    <p>[blocked] The page at
    '<a href="https://apps.facebook.com/example/?fb_source=notification&amp;ref=notif&amp;notif_t=app_notification" rel="noreferrer">https://apps.facebook.com/example/?fb_source=notification&amp;ref=notif&amp;notif_t=app_notification</a>'
    was loaded over HTTPS, but ran insecure content from
    '<a href="http://example.com/auth/facebook/callback?code=AQD5TUeTP" rel="noreferrer">http://example.com/auth/facebook/callback?code=AQD5TUeTP</a>…yXC0ZM8S45V2iTta629IaquCpAqVUbhAvNCFveaDBlbKg4J4#<em>=</em>':
    this content should also be loaded over HTTPS.</p>
  </blockquote>
  
  <pre><code>passport.use(new FacebookStrategy({
      clientID: process.env.FB_CLIENT,
      clientSecret: process.env.FB_SECRET,
      callbackURL: "/auth/facebook/callback",
      profileFields: ['id']
  },...
  
  app.get('/auth/facebook',
    passport.authenticate('facebook', {
      scope: ["read_stream"]
    })
  );
  
  app.get('/auth/facebook/callback',
    passport.authenticate('facebook', {
    failureRedirect: '/#'
  }),
  function(req, res) {
    res.redirect('/#');
  });
  </code></pre>
  
  <p>I'm running this on heroku, where it handles the details on https.</p>
  
  <p><em><strong>EDIT</em></strong>
  Apparently node provides req.connection.encrypted with information as to whether the request is https. Since I am running on heroku behind nginx where that handles all of the https before node, req.connection.encrypted will always be undefined. </p>
  
  <p>Still don't know how to solve this though.</p>