Express Trust Proxy: Does it Implicitly Enforce Secure Cookies Without secure:true?
Goal Determine whether an Express application that sets app.set('trust proxy', true) automatically treats all cookies as secure when the request arrives over HTTPS via a reverse proxy, even if the cookie options omit secure:true . Context When trust proxy is enabled, Express marks req.secure true if the X-Forwarded-Proto header equals https . The cookieParse
express