Configuration

Every app.set(name, value) setting Express recognises, plus its default and where it's consumed. Settings live on app.settings and are read with app.get(name) (or app.enabled(name) / app.disabled(name) for booleans).

Settings table

| Setting | Default | Type | Consumed by | | ------------------------ | ----------------------------------------- | ------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | -------- | --------------------------- | | case sensitive routing | undefined (falsy) | boolean | Lazy Router({ caseSensitive }) in lib/application.js. Read once on first app.use/app.METHOD. | | env | process.env.NODE_ENV ?? 'development' | string | finalhandler's env option in app.handle; view cache enabled in 'production'. | | etag | 'weak' | true / false / 'weak' / 'strong' / function | Compiled into etag fn via compileETag (lib/utils.js). Used by res.send and forwarded to send for res.sendFile. | | etag fn | (compiled from etag) | function | Internal — set by app.set('etag', ...). Reads in res.send. | | jsonp callback name | 'callback' | string | res.jsonp reads req.query[name] for the callback name. | | json escape | undefined (off) | boolean | res.json / res.jsonp. When true, <, >, & are escaped to \u003c, etc. | | json replacer | undefined | Function | Array<string | number> | Passed to JSON.stringify. | | json spaces | undefined | number / string | Passed to JSON.stringify. | | query parser | 'simple' | true / false / 'simple' / 'extended' / function | Compiled into query parser fn via compileQueryParser. | | query parser fn | (compiled from query parser) | function | Internal — read by req.query. | | strict routing | undefined (falsy) | boolean | Lazy Router({ strict }). | | subdomain offset | 2 | number | req.subdomains slice index. | | trust proxy | false | boolean / number / string / array / function | Compiled into trust proxy fn via compileTrust. | | trust proxy fn | (compiled from trust proxy) | (addr, hop) => boolean | Read by req.protocol, req.ip, req.ips, req.host. | | view | View constructor (lib/view.js) | constructor | app.render instantiates new (this.get('view'))(name, opts). Allows swapping the lookup logic. | | views | path.resolve('views') | string / string[] | View lookup root(s). | | view engine | undefined | string | Default extension when none given to res.render('email'). | | view cache | true in production, otherwise false | boolean | app.render and View to control on-disk lookup caching in app.cache. | | x-powered-by | true | boolean | app.handle sets the X-Powered-By: Express header when truthy. |

The "consumed by" column references the file path; e.g., everything that says lib/application.js is read in that file.

Per-app vs per-request

• app.locals — Object.create(null), plain bag. Set by you; read in app.render.
• res.locals — Object.create(null) per request, set by app.handle if not present. Read in res.render and merged into app.render opts.

Mounted-app inheritance

When a sub-app is mounted (app.use('/admin', subApp)), the sub-app's engines, request, response, and settings prototypes are reparented to the parent's via Object.setPrototypeOf on the 'mount' event. This means a sub-app sees parent settings unless it has explicitly set its own.

For trust proxy specifically, a sentinel symbol (@@symbol:trust_proxy_default) tracks whether the child still has the framework default. If so, and the parent has set its own, the child's defaults are deleted so they fall through.

Setting a setting

app.set('trust proxy', 'loopback'); // string
app.set('trust proxy', ['loopback', '10.0.0.0/8']); // array
app.set('trust proxy', 1); // hop count
app.set('trust proxy', true); // trust everything
app.set('trust proxy', (ip, i) => true); // custom fn

app.enable('etag'); // app.set('etag', true)
app.disable('etag'); // app.set('etag', false)
app.enabled('etag'); // → boolean

Reading a setting

app.get('trust proxy'); // raw value as set
app.get('trust proxy fn'); // compiled function (used internally)

app.get(name) with a single argument is a getter. With more arguments, it registers an HTTP GET route — see Routing and middleware.

Related pages

• Application — implementation of the settings store.
• Utils — compile helpers.
• Glossary — definitions of "setting", "trust proxy", "etag fn", etc.