Question
Express Trust Proxy: Does it Implicitly Enforce Secure Cookies Without secure:true?
Sky Vale
0 reputation · 02 Dec 2020, 02:06 UTC
135.7K views1
Loading…
0 reputation · 02 Dec 2020, 02:06 UTC
Determine whether an Express application that sets app.set('trust proxy', true) automatically treats all cookies as secure when the request arrives over HTTPS via a reverse proxy, even if the cookie options omit secure:true.
When trust proxy is enabled, Express marks req.secure true if the X-Forwarded-Proto header equals https. The cookieParser middleware then attaches cookies to the request, and the Set-Cookie header is generated based on the cookie options. However, the Express documentation does not clarify whether a cookie lacking an explicit secure:true flag should be considered secure under this configuration.
The behavior is ambiguous: is the secure flag automatically applied when trust proxy is true, or must developers explicitly set secure:true in each cookie? This distinction is critical for preventing cookie theft in production deployments that rely on HTTPS termination at a load balancer.
trust proxy is true and X-Forwarded-Proto is https, does Express set the secure flag on cookies that lack an explicit secure:true option?34775 reputation · 02 Dec 2020, 08:13 UTC
No. Setting app.set('trust proxy', true) does not cause Express (or the cookie-parser middleware) to automatically add the Secure attribute to cookies that omit secure:true. The flag must be set explicitly in each cookie’s options.
The trust proxy option only affects how Express interprets the X-Forwarded-Proto header to set req.secure, req.protocol, and related helpers. Cookie header generation is handled by the cookie middleware, which uses the options passed to res.cookie() verbatim. No Express source code or documentation shows a transformation that injects Secure based on req.secure.
expressconst express=require('express');
const app=express();
app.set('trust proxy', true);
app.get('/', (req,res)=>{
res.cookie('token', 'abc123'); // no secure:true
res.send('ok');
});
app.listen(3000);X-Forwarded-Proto: https:
curl -I -H 'X-Forwarded-Proto: https' http://localhost:3000/Set-Cookie header. It will lack the Secure flag.secure:true to the cookie options and repeat – the Secure attribute appears.secure:true for cookies that should only travel over HTTPS, regardless of proxy configuration.
httpOnly:true and sameSite: 'strict' (or 'lax') to strengthen security.
express-session), set cookie: { secure: true, httpOnly: true, sameSite: 'strict' } in the session options.
X-Forwarded-Proto: https header so that req.secure reflects the true protocol.
res.cookie options globally, e.g., by wrapping the cookie function.
If you use custom cookie handling or third‑party libraries that manipulate cookie headers, verify their documentation. They may have built‑in defaults that differ from cookie-parser.
Use comments to ask for clarification. Post a solution as an answer.
6,260 reputation · 02 Dec 2020, 07:25 UTC
Enabling app.set('trust proxy', true) only changes how Express interprets the X-Forwarded-Proto header to set req.secure and req.protocol. The cookie‑setting logic in res.cookie() (or the cookie-parser middleware) reads the options you pass directly and does not consult req.secure to inject a Secure attribute. Therefore, a cookie created without { secure: true } will lack the Secure flag even when the request arrives over HTTPS via a proxy.
Verification: run a minimal Express app with trust proxy enabled, send a request with X-Forwarded-Proto: https, and inspect the Set-Cookie header – it will not contain Secure. Adding secure: true to the options will cause the flag to appear, confirming that the behavior is explicit.