HSTS issue

server.js

@@ -13,14 +13,22 @@ require("dotenv").config();
  
 const app = express();
 
+// REQUIRED for HSTS when behind proxy (AWS ALB / Nginx / Cloudflare)
+app.set("trust proxy", 1);
+
+const isLocal = process.env.NODE_ENV === "development";
+
 // GLOBAL MIDDLEWARE (body parsing)
 app.use(express.json());
 app.use(cookieParser());
+
+// HELMET 
 app.use(
   helmet({
     contentSecurityPolicy: false,
   })
 );
+
 // prevent framing (clickjacking protection)
 app.use(
   helmet.frameguard({
@@ -28,26 +36,20 @@ app.use(
   })
 );
 
-// Add HSTS explicitly (fixes scanner warning)
-if (process.env.NODE_ENV === "production") {
+//HSTS (ENABLE FOR UAT + PROD)
+if (!isLocal) {
   app.use(
     helmet.hsts({
-      maxAge: 31536000,          // 1 year
+      maxAge: 31536000, // 1 year
       includeSubDomains: true,
       preload: true,
     })
   );
 }
+
 app.use(morgan("dev"));
 app.use(sanitizeInput);
 
-// app.use(cors());
-// const allowedOrigins = [
-//   "http://localhost:5173",     //local
-//   "http://13.201.47.205:5173", //dev
-//   "http://13.201.47.205:5175",  //uat
-//   "https://ipi.venbait.in/api"  // backend
-// ];
 const allowedOrigins = process.env.ALLOWED_ORIGINS
   ? process.env.ALLOWED_ORIGINS.split(",").map(origin => origin.trim())
   : [];
@@ -83,34 +85,7 @@ app.use((req, res, next) => {
 
 
 
-// // Swagger setup
-// const swaggerOptions = {
-//   definition: {
-//     openapi: "3.0.0",
-//     info: {
-//       title: "FCSC IPI Survey",
-//       version: "1.0.0",
-//       description: "Federal Competitiveness and Statistics Centre (FCSC) - Industrial Production Index (IPI)",
-//     },
-//     components: {
-//       securitySchemes: {
-//         bearerAuth: {
-//           type: "http",
-//           scheme: "bearer",
-//           bearerFormat: "JWT",
-//         },
-//       },
-//     },
-//     security: [
-//       {
-//         bearerAuth: [],
-//       },
-//     ],
-//   },
-//   apis: ["./app/routes/*.js"],
-// };
-// const swaggerDocs = swaggerJsdoc(swaggerOptions);
-// app.use("/api-docs", swaggerUi.serve, swaggerUi.setup(swaggerDocs));
+
 // Swagger setup
 const swaggerOptions = {
   definition: {