Expose a local Express app

Reach your Express app from outside your laptop, with an HTTPS URL, and make req.hostname return the public host.

Before you beginCopy Anchor Link

• Node.js 18 or later
• A Horizon account and the CLI (see Getting started)
• A reserved subdomain for -s. Reserve one on the Subdomains page.
• npm install express

const express = require("express");

const app = express();
app.set("trust proxy", "loopback");

app.get("/", (req, res) => {
  res.json({
    hostname: req.hostname,
    protocol: req.protocol,
    host: req.get("host"),
    forwardedHost: req.get("x-forwarded-host"),
    forwardedProto: req.get("x-forwarded-proto"),
  });
});

app.listen(3000, () => console.log("Listening on http://localhost:3000"));

node server.js

hrzn tunnel http://localhost:3000 -s my-app

HORIZON: Tunnel connected
  URL          https://my-app.hrzn.run (reserved)
  Forwarding   http://localhost:3000
  Request log  https://hrzn.run/dashboard/tunnels/my-app

curl https://my-app.hrzn.run/

Check it worksCopy Anchor Link

The Horizon terminal prints GET 200 /. The JSON shows which headers reached Express. host is localhost:3000, because the Horizon CLI sets Host to the address you tunnel to. forwardedHost is my-app.hrzn.run. With trust proxy set, hostname is the value of X-Forwarded-Host.

Without the app.set line, req.hostname is localhost. Express reads X-Forwarded-Host only when trust proxy allows it.

Choose a trust proxy valueCopy Anchor Link

Express's default is false: it treats the app as facing the client directly. Pick the narrowest value that fits.

Express warns that with true, the last trusted proxy must remove or overwrite X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Proto. Otherwise a client can send any value.

Build absolute URLs from the public hostCopy Anchor Link

Your app sees Host: localhost:3000. An OAuth redirect URI built from Host points at localhost. Build it from req.protocol and req.hostname after you set trust proxy, or set the public URL in an environment variable.

app.get("/login", (req, res) => {
  const redirectUri = `${req.protocol}://${req.hostname}/auth/callback`;
  res.json({ redirectUri });
});

req.protocol reads X-Forwarded-Proto when trust proxy allows it. Check the forwardedProto value in the JSON above. If it is null, req.protocol is http, so hard-code https for tunnel URLs or read the public URL from an environment variable.

TroubleshootingCopy Anchor Link

Error: listen EADDRINUSE: address already in use :::3000Copy Anchor Link

Another process holds port 3000. Stop it, or change the port in app.listen and in the tunnel command.

req.hostname returns localhostCopy Anchor Link

You didn't set trust proxy, or the request doesn't come from an address it trusts. Set app.set("trust proxy", "loopback") and check forwardedHost in the JSON.

Nothing reaches your appCopy Anchor Link

Check that the Horizon terminal is still running. If its last line is Connection lost. Reconnecting…, wait for Reconnected.

The URL changed after a restartCopy Anchor Link

You started the tunnel without -s, so Horizon gave you a new random subdomain. Restart with -s my-app.

Next stepsCopy Anchor Link

• Read Express's guide to running behind proxies.