Example update proxy for electron

updateProxy.ts

import http from "http";
import https from "https";
import {
	AddressInfo,
} from "net";
import { URL } from "url";

const updateServer = "https://updates.yourserver.com/path/to/update/dir/without/trailing/slash";
const updateAuth = `Basic ${Buffer.from("username:password").toString("base64")}`

export function startUpdateProxy() {
	return new Promise<{ url: string; server: http.Server}>((res, rej) => {

		const server = http.createServer((request, response) => {
			const requestURL = new URL(updateServer + request.url);
			const endReq = https.request(requestURL, {
				headers: {
					...request.headers,
					Authorization: updateAuth,
					Host: requestURL.host,
				},
			}, (endRes) => {
				response.writeHead(endRes.statusCode || 500, endRes.headers);
				endRes.pipe(response);
				endRes.on("error", (err) => response.destroy(err));
			});
			request.pipe(endReq);
			endReq.on("error", (err) => response.writeHead(500, `${String(err)} when connecting to ${updateServer + request.url}`).end());
		});
		server.listen({
			host: "127.0.0.1",
			port: 0,
		});
		server.on("listening", () => {
			res({
				url: `http://127.0.0.1:${(server.address() as AddressInfo).port}`,
				server,
			});
		});
		server.on("error", rej);

	});
}

Docs

Calling startUpdateProxy() returns a promise resolving to an object with url and server props. The url can be passed directly into the autoUpdater.setFeedURL(...) function, while the server prop can be used for more granular control of the server, for example, stopping it. This function can also be used in a JS-based build system, allowing you to extend electron-winstaller to use your authenticated update server.

updateServer is the URL to your update server, and updateAuth is the value of the Authorization header in the request

Though it can be, I would not recommend merely copying and pasting this code, because it's important to understand how it works. Instead, please use this as a guide for rolling your own solution. When dealing with security, never take someone else's script at face value unless it has been extensively tested and vetted by the community (and even then, be wary).

This code was inspired by this issue thread, and partly by the specific issue linked because I still wanted delta updates and didn't want to have to write my own manifest parser. Unfortunately, these requirements complicate matters quite a bit, so why not let Squirrel do the heavy lifting (that's what it was made for anyways, wasn't it?) and just intercept requests?

electron/electron#5020 (comment)