expressjs / csurf

CSRF token middleware
MIT License
2.3k stars 216 forks source link

Add support for cookie.secure === 'auto' #242

Open STRML opened 3 years ago

STRML commented 3 years ago

This mirrors support in express-session where we look at the value of req.headers['x-forwarded-proto'] to automatically determine if we should set Secure.

This provides the developer with a safe way of getting Secure set, without relying on complicated logic to detect development environments or set up branching middleware chains.