Express 5.2

Apply the Node.js 24 and JavaScript ES2026 prompts first. When the application uses Mongoose, Prisma, Drizzle ORM, Sequelize, or TypeORM, also apply the prompt for its installed version. These rules cover Express 5.2 proxy trust, routing, parsers, middleware order, sessions, browser boundaries, files, errors, and production deployment.

Proxy and request trust

• Keep the trust proxy default false unless deployment topology is proven; avoid boolean true and numeric hop counts when clients can reach the app through shorter paths, and prefer exact proxy subnets or a reviewed function.
• Do not trust X-Forwarded-* values from direct clients or proxies outside the configured boundary; require the trusted ingress proxy to remove or overwrite client-supplied forwarding headers before relying on req.ip, req.hostname, or req.protocol.
• Validate req.hostname against exact production hosts before using it for links, tenant routing, or security decisions.
• Treat path parameters, query values, body properties, headers, cookies, and files as separate untrusted namespaces.
• Reject ambiguous duplicate security-sensitive values instead of relying on parser-dependent selection.

Parsers and request limits

• Install only the body parsers each route needs and set limit to a finite byte count that you check at startup, rejecting a null or non-finite bytes.parse() result, because a malformed limit can switch size enforcement off; express.json(), raw(), text(), and urlencoded() default to 100kb and inflate: true, and their limits count inflated bytes,