Express 4.22

Apply the Node.js 24 and JavaScript ES2026 prompts first. These rules cover Express 4.22 proxy trust, routing, parsers, middleware order, sessions, browser boundaries, files, errors, and production deployment.

Proxy and request trust

• Keep the trust proxy default false unless deployment topology is proven; avoid boolean true and numeric hop counts when clients can reach the app through shorter paths, and prefer exact proxy subnets or a reviewed function.
• Write IPv4 trust proxy subnets in plain notation such as 10.0.0.0/8. Never use an IPv4-mapped IPv6 subnet with a short prefix such as ::ffff:10.0.0.0/8, or an IPv6 block with zero leading bits such as ::/1, because proxy-addr can compile them to a different block, up to every IPv4 client; if mapped notation is required, write the full prefix such as ::ffff:10.0.0.0/104. Test that a direct client's X-Forwarded-For does not change req.ip or req.ips.
• Do not trust X-Forwarded-* values from direct clients or proxies outside the configured boundary.
• Validate req.hostname against exact production hosts before using it for links, tenant routing, or security decisions.
• Treat path parameters, query values, body properties, headers, cookies, and files as separate untrusted namespaces.
• Reject ambiguous duplicate security-sensitive values instead of relying on parser-dependent selection.

Parsers and request limits

• Install only the body parsers each route needs and set valid, finite byte limits. Check any configured or computed limit at startup with bytes.parse() and refuse to start