Expressjs secure session cookie

Question

I cant seem to find a way to set a secure cookie in expressjs framework. Is there an option to do this somewhere?

Answer 1

If you are behind a proxy, you also have to ensure it is sending the X-Forwarded-Proto header and that you set the proxy option:

app.use(express.session({
  proxy: true,
  secret: 'test',
  cookie: {
    secure: true
  }            
}));

Alternatively, you can tell Express to trust the proxy globally:

app.set('trust proxy', 1)