evilpacket/helmet — pull request #2 by hatchan (2012-09-26 14:18:30+00:00)
Title: Use req.secure (if set)

My req.connection.encrypted is always undefined, so use req.secure (http://expressjs.com/api.html#req.secure) if it is set, it also checks 'X-Forwarded-Proto' header (if the user trusts the proxy, http://expressjs.com/api.html#req.protocol)