ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
An architecture note on Express trust proxy: how req.ip, req.protocol and req.hostname change behind a reverse proxy, the smallest safe trust setting, spoofing and rate-limit failure modes, and when to redesign.
When Express sits behind Nginx or a CDN, req.ip is wrong by default. Learn how trust proxy works, configure trusted hops safely, and verify client-IP behavior without exposing your app to header spoofing.
Goal Determine whether an Express application that sets app.set('trust proxy', true) automatically treats all cookies as secure when the request arrives over HTTPS via a reverse proxy, even if the cookie options omit secure:true . Context When trust proxy is enabled, Express marks req.secure true if the X-Forwarded-Proto header equals https . The cookieParse
express