Flag to enforce API requests over SSL

config.default.json

@@ -48,7 +48,8 @@
     "report": []
   },
   "api": {
-    "allowAnonymous": true
+    "allowAnonymous": true,
+    "requireSSL": false
   },
   "blacklist": {
     "html": ["processform.cgi", "habbo.com"],

lib/middleware.js

@@ -189,6 +189,15 @@ module.exports = {
 
       if (req.url.indexOf('/api') === 0) {
         req.isApi = true;
+
+        if (config.api.requireSSL) {
+          if (!req.secure && (String(req.headers['x-forwarded-proto']).toLowerCase() !== "https") ) {
+            res.status(403); // forbidden
+            res.json({ error: 'All API requests must be made over SSL/TLS' });
+            return;
+          }
+        }
+
         if (req.query.api_key) {
           apiKey = req.query.api_key;
         } else if (req.headers.authorization) {