The answer
Set app.set('trust proxy', 1) in Express. This makes req.protocol return 'https', req.secure return true, and req.ip return the real client IP (from X-Forwarded-For). Set secure: true on cookies so they're only sent over HTTPS.
Nginx SSL and HTTPS Configuration Secure Your Node.js App with Let's Encrypt
How do I make Express.js work behind an Nginx SSL proxy?
More FAQs in Nginx SSL and HTTPS Configuration Secure Your Node.js App with Let's Encrypt
Install certbot, run sudo certbot --nginx -d yourdomain.com. Certbot obtains the SSL certificate and modifies Nginx config automatically. It adds listen 443 ssl, certificate paths, and HTTP to HTTPS redirect. Set up auto-renewal with certbot renew --dry-run.
Use ssl_protocols TLSv1.2 TLSv1.3 (disable TLSv1.0 and 1.1 as they're insecure). Use ssl_ciphers HIGH:!aNULL:!MD5 for strong ciphers only. Set ssl_prefer_server_ciphers on and ssl_session_cache shared:SSL:10m for performance.
Create a server block with listen 80 and return 301 https://$host$request_uri. This permanently redirects all HTTP traffic to HTTPS. Certbot adds this automatically when you run it with the --nginx flag.
Still have questions?
Browse all our FAQs or reach out to our support team
Want to upskill yourself?
Your learning library
Small steps. Big possibilities.
Find your next course. Build something great.