florianheinemann
Throw error instead of res.status(403)
In many cases, I would want to handle error in a different way than sending a 403 with a hardcoded text message ("Please use HTTPS when submitting data to this server.").
This alternative falls short if I am rendering and serving a custom HTML view, serving an API with standarized error structure, a public website with customized error pages, or want to perform some custom action before actually redirecting, and a big, big etc.
Without going any further, just trying to localise the app, I have no way of at least customize the text message.
So for flexibility, I think it would be better to just throw a SSLRequiredError and let the developer decide what to do with that. He/she can catch it in an error middleware and handle it accordingly.
For compatibility issues, maybe you can pass a throwError boolean property in options that throws this SSLRequired error if activated, and sends the current 403 with the hardcoded message, otherwise.
I will gladly make the necessary fixes and submit a PR, but would like to listen to your opinion before start coding anything.
