Identify the proxy addresses or trusted hop structure and whether users can reach the upstream listener directly. Record which forwarded headers the proxy overwrites.

1. Configure trust proxy for the known trusted addresses or a carefully verified topology. Avoid enabling unrestricted trust merely to make one redirect work.

2. Ensure the last trusted proxy removes or replaces untrusted forwarded host, protocol and address values according to the deployment design.

3. Test URL generation, redirects, client-address logging and HTTPS-only cookies through the public endpoint.

4. Apply authentication and rate limits using the resulting trusted request information. Verify that a spoofed forwarded header cannot bypass an intended limit.

5. Keep the upstream listener restricted to the approved network path and document the configuration for future proxy changes.

If the application is reachable only through a trusted reverse proxy on the same server, a specific address-based trust setting can be clearer than trusting every forwarded value. Use this example only after confirming that topology and its header replacement behaviour.

app.set('trust proxy', ['127.0.0.1', '::1']);

The edge must replace untrusted forwarded protocol, host and address information, and the upstream listener must not be publicly reachable. If your hosting integration uses different proxy addresses or several paths, use its documented trust boundary instead. Keep canonical-host validation and application authentication separate from proxy trust.

Expected result: The application recognises HTTPS and the intended client address through the legitimate path. A controlled request with forged forwarded headers does not choose a different identity or bypass a rate limit. Test session cookies and redirects as well as the homepage before accepting the change.

Compare the expected scheme and client identity with the values used by the application. Test both the normal path and a controlled attempt to provide a false forwarded value.

An incorrect hop count can become unsafe when traffic has more than one route to the app. Prefer a trust model that remains valid for every permitted path.

• Starting a Node app with the assigned production port
• Storing Express sessions outside process memory
• Troubleshooting browser CORS errors for an API
• Diagnosing an Express upload size failure

• Express behind proxies

• Express trusted proxy configuration