Can Heroku force an application to use SSL/TLS?
Redirects need to be performed at the application level as the Heroku router does not provide this functionality. You should code the redirect logic into your application.
Under the hood, Heroku router (over)writes the
X-Forwarded-Proto and the
X-Forwarded-Port request headers. The app checks
X-Forwarded-Proto and respond with a redirect response when it is not
config.force_ssl = true in your
config/environments/production.rb or similar.
Use a package to set this up for your app. Some options can be found here: https://www.npmjs.com/search?q=express+ssl
You can add directives to the
.htaccess file at the root of your project to do this. See this SO post for an example https://stackoverflow.com/a/34065445