From ebffd8a3ca02b0d2f213d9528c1ca7d590180e63 Mon Sep 17 00:00:00 2001 From: Kerim Atilgan Date: Thu, 14 May 2026 21:45:26 +0200 Subject: [PATCH] Fix login loop behind reverse proxy: trust X-Forwarded-Proto In production we run behind nginx that terminates HTTPS and proxies HTTP to node:3000. Without app.set('trust proxy', 1) Express sees the connection as plaintext, so express-session refuses to set the secure cookie. Login appeared to succeed but no cookie was issued, causing an immediate redirect back to /login on the next request. Co-Authored-By: Claude Opus 4.7 (1M context) --- server.js | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/server.js b/server.js index cef946c..b709627 100644 --- a/server.js +++ b/server.js @@ -18,6 +18,13 @@ const app = express(); const PORT = process.env.PORT || 3000; const isProd = process.env.NODE_ENV === 'production'; +// We sit behind nginx/PM2 in production; trust X-Forwarded-* headers so that +// req.secure reflects the actual client connection (otherwise secure cookies +// would never be set and rate-limiting would treat every client as the same IP). +if (isProd) { + app.set('trust proxy', 1); +} + initDatabase(); // Graceful shutdown