title: NodeJS, Express, why should I use app.enable('trust proxy');
body: <p>I was needed to redirect http to https and found this code:</p>
  
  <pre><code>app.enable('trust proxy');
  app.use((req, res, next) =&gt; {
      if (req.secure) {
          next();
      } else {
          res.redirect('https://' + req.headers.host + req.url);
      }
  });
  </code></pre>
  
  <p>I'm using heroku to host my project, I noticed that heroku as default issued <code>*.herokuapp.com</code> cert, so I can use http and https as well.</p>
  
  <p>When looked at <code>req.secure</code> within <code>app.use</code> callback, without <code>app.enable('trust proxy')</code>, <code>req.secure</code> is always <code>false</code>, when I add <code>app.enable('trust proxy')</code> it's false for about 2 times and after the <code>https</code> redirection it's switches to <code>true</code>.</p>
  
  <p><code>app.enable('trust proxy')</code>, <a href="http://expressjs.com/en/api.html#app.settings.table" rel="noreferrer">the docs:</a></p>
  
  <blockquote>
    <p>Indicates the app is behind a front-facing proxy, and to use the
    X-Forwarded-* headers to determine the connection and the IP address
    of the client.</p>
  </blockquote>
  
  <p><strong>My question:</strong></p>
  
  <p>Why would my server be behind a proxy?(is it relates to the issued <code>*.herokuapp.com</code> cert?), if someone could explain how all fits together, I mean, why my server is behind a proxy? and why without <code>app.enable</code> express won't identify(or accept) secure connection?</p>