Integrate force-ssl and absolute-url. Now when you add force-ssl, secure defaults to true in absolute-url.

packages/absolute-url/url_common.js

@@ -14,7 +14,12 @@
     if (path)
       url += path;
 
-    if (options.secure && /^http:/.test(url)) // startsWith(url, 'http:')
+    // turn http to http if secure option is set, and we're not talking
+    // to localhost.
+    if (options.secure &&
+        /^http:/.test(url) && // startsWith('http:')
+        !/http:\/\/localhost[:\/]/.test(url) && // doesn't match localhost
+        !/http:\/\/127\.0\.0\.1[:\/]/.test(url)) // or 127.0.0.1
       url = url.replace(/^http:/, 'https:');
 
     return url;

packages/absolute-url/url_tests.js

@@ -19,6 +19,21 @@ Tinytest.add("absolute-url - basics", function(test) {
   test.equal(Meteor.absoluteUrl('foo', {rootUrl: 'https://asdf.com',
                                          secure: false}),
              'https://asdf.com/foo');
+
+  test.equal(Meteor.absoluteUrl('foo', {rootUrl: 'http://localhost',
+                                         secure: true}),
+             'http://localhost/foo');
+  test.equal(Meteor.absoluteUrl('foo', {rootUrl: 'http://localhost:3000',
+                                         secure: true}),
+             'http://localhost:3000/foo');
+  test.equal(Meteor.absoluteUrl('foo', {rootUrl: 'https://localhost:3000',
+                                         secure: true}),
+             'https://localhost:3000/foo');
+  test.equal(Meteor.absoluteUrl('foo', {rootUrl: 'http://127.0.0.1:3000',
+                                         secure: true}),
+             'http://127.0.0.1:3000/foo');
+
+
 });
 
 

packages/force-ssl/force_ssl_common.js

@@ -0,0 +1 @@
+_.extend(Meteor.absoluteUrl.defaultOptions, {secure: true});

packages/force-ssl/package.js

@@ -7,6 +7,13 @@ Package.on_use(function (api) {
   // make sure we come after livedata, so we load after the sockjs
   // server has been instantiated.
   api.use('livedata', 'server');
+
+  // we don't really depend on absolute-url, but we do modify its
+  // behavior. If there were a way to say "if the other package is
+  // loaded, make sure we come after it", we should do that here.
+  api.use('absolute-url', ['client', 'server']);
+
+  api.add_files('force_ssl_common.js', ['client', 'server']);
   api.add_files('force_ssl_server.js', 'server');
 
   // Another thing we could do is add a force_ssl_client.js file that