Express is configured to trust EVERY proxy (app.set('trust proxy', true) or the equivalent app.enable('trust proxy')).

Why this matters

With unbounded trust, Express believes the X-Forwarded-For and X-Forwarded-Proto headers on any incoming request. A client can then spoof its source IP (defeating IP allowlists, rate limiters, and audit logs) and spoof https, which can trick secure session cookies into being sent over plain HTTP.

Set trust proxy to the number of proxies actually in front of the app (e.g. app.set('trust proxy', 1)), or to a specific address / subnet / preset ('loopback', 'uniquelocal', a CIDR, or an allowlist array), so only your real infrastructure is trusted. Never trust all proxies.

import express from 'express';

const app = express();

// ruleid: auth.express.trust-proxy-true
app.set('trust proxy', true);

// ruleid: auth.express.trust-proxy-true
app.enable('trust proxy');

import express from 'express';

const app = express();

// ok: auth.express.trust-proxy-true -- bounded hop count (one proxy in front)
app.set('trust proxy', 1);

// ok: auth.express.trust-proxy-true -- a specific preset, not "all proxies"
app.set('trust proxy', 'loopback');

// ok: auth.express.trust-proxy-true -- an explicit allowlist of trusted addresses
app.set('trust proxy', ['loopback', '127.0.0.1', '10.0.0.0/8']);

// ok: auth.express.trust-proxy-true -- trust disabled entirely
app.set('trust proxy', false);
app.disable('trust proxy');

// ok: auth.express.trust-proxy-true -- an unrelated setting, not trust proxy
app.set('view engine', 'pug');

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.express.trust-proxy-true -- <reason>

References