Feature request: configurable header name for x-forwarded-proto

Hi,

Would it be possible to make the exact header-name checked for in line 640 of index.js to be a config option instead of hard coded to “x-forwarded-proto” please ?

The reason I ask is that we have a deployment situation where there are 2 AWS load balancers sequentially reverse proxying before the express code is requested, and the 2nd one unfortunately overwrites the x-forwarded-proto set by the 1st (which has the value we want).

In other applications we’ve been able to write the 1st LB’s x-forwarded-proto into another header so it’s visible downstream, and then look at the other header. Unfortunately without forking and modifying express-session’s source, we can’t find a way to trick express-session’s issecure() method into looking at that other named header, so all secure cookies are dropped.

I’m happy to fork and maintain a clone if its the only way, but I just thought I’d ask: if it’s possible to take the header name to use instead of x-forwarded-proto as an option in the session constructor that could be overridden or a custom getXForwardedProtoHeaderValue() function be supplied it would make that unnecessary.

Happy to write a patch if it would help and submit, just wanting to sound out whether it’s an option or not. Thank you,

Rick Knowles

[dougwilson]

http://expressjs.com/en/guide/overriding-express-api.html

Object.defineProperty(app.request, 'secure', {
  configurable: true,
  enumerable: true,
  get: function () { return getXForwardedProtoHeaderValue() === 'https' }
})

[rickknowles-cognitant]

thank you - v helpful