From d98e2e74983e5ec84bdb86abdb02339cdf77bda1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 13 May 2014 17:06:45 -0400
Subject: [PATCH 01/13] deprecation messages are bright red on TTYs

---
 lib/utils.js | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/lib/utils.js b/lib/utils.js
index fa76e041..74d86258 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -14,7 +14,8 @@ var mime = require('connect').mime
 var toString = {}.toString;
 
 /**
- * Deprecate function, like core `util.deprecate`
+ * Deprecate function, like core `util.deprecate`,
+ * but with NODE_ENV and color support.
  *
  * @param {Function} fn
  * @param {String} msg
@@ -23,9 +24,17 @@ var toString = {}.toString;
  */
 
 exports.deprecate = function(fn, msg){
-  return 'test' !== process.env.NODE_ENV
-    ? deprecate(fn, 'express: ' + msg)
-    : fn;
+  if (process.env.NODE_ENV === 'test') return fn;
+
+  // prepend module name
+  msg = 'express: ' + msg;
+
+  if (process.stderr.isTTY) {
+    // colorize
+    msg = '\x1b[31;1m' + msg + '\x1b[0m';
+  }
+
+  return deprecate(fn, msg);
 };
 
 /**

From 65f13c3cc62ff2f5162df73f78b4e5e451adf3b3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 17 May 2014 14:30:52 -0400
Subject: [PATCH 02/13] update connect to 2.16.1

---
 History.md           | 13 +++++++++++++
 lib/request.js       |  2 +-
 lib/response.js      |  6 +++---
 lib/router/index.js  | 14 +++++++-------
 package.json         |  3 ++-
 test/res.sendfile.js |  6 +++---
 6 files changed, 29 insertions(+), 15 deletions(-)

diff --git a/History.md b/History.md
index 2a5ee82f..37dd908a 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,16 @@
+3.x
+===
+
+ * update connect to 2.16.1
+   - deprecate `res.headerSent` -- use `res.headersSent`
+   - deprecate `res.on("header")` -- use on-headers module instead
+   - json: use body-parser
+   - urlencoded: use body-parser
+   - dep: bytes@1.0.0
+   - dep: cookie-parser@1.1.0
+   - dep: csurf@1.2.0
+   - dep: express-session@1.1.0
+
 3.6.0 / 2014-05-09
 ==================
 
diff --git a/lib/request.js b/lib/request.js
index 10c1421a..34575ee2 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -8,7 +8,7 @@ var http = require('http')
   , connect = require('connect')
   , fresh = require('fresh')
   , parseRange = require('range-parser')
-  , parse = connect.utils.parseUrl
+  , parse = require('parseurl')
   , mime = connect.mime;
 
 /**
diff --git a/lib/response.js b/lib/response.js
index e21d2cbd..8054e5ca 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -334,13 +334,13 @@ res.sendfile = function(path, options, fn){
 
     // clean up
     cleanup();
-    if (!self.headerSent) self.removeHeader('Content-Disposition');
+    if (!self.headersSent) self.removeHeader('Content-Disposition');
 
     // callback available
     if (fn) return fn(err);
 
     // list in limbo if there's no callback
-    if (self.headerSent) return;
+    if (self.headersSent) return;
 
     // delegate
     next(err);
@@ -375,7 +375,7 @@ res.sendfile = function(path, options, fn){
  * Optionally providing an alternate attachment `filename`,
  * and optional callback `fn(err)`. The callback is invoked
  * when the data transfer is complete, or when an error has
- * ocurred. Be sure to check `res.headerSent` if you plan to respond.
+ * ocurred. Be sure to check `res.headersSent` if you plan to respond.
  *
  * This method uses `res.sendfile()`.
  *
diff --git a/lib/router/index.js b/lib/router/index.js
index cd2f2693..79997c6f 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -2,11 +2,11 @@
  * Module dependencies.
  */
 
-var Route = require('./route')
-  , utils = require('../utils')
-  , methods = require('methods')
-  , debug = require('debug')('express:router')
-  , parse = require('connect').utils.parseUrl;
+var Route = require('./route');
+var utils = require('../utils');
+var methods = require('methods');
+var debug = require('debug')('express:router');
+var parseUrl = require('parseurl');
 
 /**
  * Expose `Router` constructor.
@@ -182,7 +182,7 @@ Router.prototype._dispatch = function(req, res, next){
  */
 
 Router.prototype._options = function(req, res, next){
-  var path = parse(req).pathname
+  var path = parseUrl(req).pathname
     , body = this._optionsFor(path).join(',');
   if (!body) return next();
   res.set('Allow', body).send(body);
@@ -222,7 +222,7 @@ Router.prototype._optionsFor = function(path){
 
 Router.prototype.matchRequest = function(req, i, head){
   var method = req.method.toLowerCase()
-    , url = parse(req)
+    , url = parseUrl(req)
     , path = url.pathname
     , routes = this.map
     , i = i || 0
diff --git a/package.json b/package.json
index e902140b..dea6c3e1 100644
--- a/package.json
+++ b/package.json
@@ -34,10 +34,11 @@
     }
   ],
   "dependencies": {
-    "connect": "2.15.0",
+    "connect": "2.16.1",
     "commander": "1.3.2",
     "methods": "1.0.0",
     "mkdirp": "0.5.0",
+    "parseurl": "1.0.1",
     "range-parser": "1.0.0",
     "cookie": "0.1.2",
     "buffer-crc32": "0.2.1",
diff --git a/test/res.sendfile.js b/test/res.sendfile.js
index 30c2ebe0..5532a5a5 100644
--- a/test/res.sendfile.js
+++ b/test/res.sendfile.js
@@ -42,7 +42,7 @@ describe('res', function(){
       app.use(function(req, res){
         res.sendfile('test/fixtures/nope.html', function(err){
           ++calls;
-          assert(!res.headerSent);
+          assert(!res.headersSent);
           res.send(err.message);
         });
       });
@@ -77,7 +77,7 @@ describe('res', function(){
 
       app.use(function(req, res){
         res.sendfile('test/fixtures/foo/../user.html', function(err){
-          assert(!res.headerSent);
+          assert(!res.headersSent);
           ++calls;
           res.send(err.message);
         });
@@ -95,7 +95,7 @@ describe('res', function(){
 
       app.use(function(req, res){
         res.sendfile('test/fixtures/user.html', function(err){
-          assert(!res.headerSent);
+          assert(!res.headersSent);
           req.socket.listeners('error').should.have.length(1); // node's original handler
           done();
         });

From 566720be15838f3fe9b30263a7058a8b497c28f5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 9 May 2014 00:53:47 -0400
Subject: [PATCH 03/13] improve proxy trust with ip address list

closes #2099
---
 History.md           |  8 ++++++
 lib/application.js   |  8 ++++++
 lib/request.js       | 63 +++++++++++++++++++++++++++---------------
 lib/utils.js         | 30 ++++++++++++++++++++
 package.json         |  1 +
 test/req.host.js     | 65 ++++++++++++++++++++++++++++++++++++++++++++
 test/req.ip.js       | 15 ++++++++++
 test/req.ips.js      | 15 ++++++++++
 test/req.protocol.js | 15 ++++++++++
 9 files changed, 198 insertions(+), 22 deletions(-)

diff --git a/History.md b/History.md
index 37dd908a..6226f105 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,14 @@
 3.x
 ===
 
+ * proper proxy trust with `app.set('trust proxy', trust)`
+   - `app.set('trust proxy', 1)` trust first hop
+   - `app.set('trust proxy', 'loopback')` trust loopback addresses
+   - `app.set('trust proxy', '10.0.0.1')` trust single IP
+   - `app.set('trust proxy', '10.0.0.1/16')` trust subnet
+   - `app.set('trust proxy', '10.0.0.1, 10.0.0.2')` trust list
+   - `app.set('trust proxy', false)` turn off
+   - `app.set('trust proxy', true)` trust everything
  * update connect to 2.16.1
    - deprecate `res.headerSent` -- use `res.headersSent`
    - deprecate `res.on("header")` -- use on-headers module instead
diff --git a/lib/application.js b/lib/application.js
index 10233eff..3408f68e 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -8,6 +8,7 @@ var connect = require('connect')
   , middleware = require('./middleware')
   , debug = require('debug')('express:application')
   , locals = require('./utils').locals
+  , compileTrust = require('./utils').compileTrust
   , View = require('./view')
   , utils = connect.utils
   , deprecate = require('./utils').deprecate
@@ -48,6 +49,7 @@ app.defaultConfiguration = function(){
   this.enable('etag');
   this.set('env', process.env.NODE_ENV || 'development');
   this.set('subdomain offset', 2);
+  this.set('trust proxy', false);
   debug('booting in %s mode', this.get('env'));
 
   // implicit middleware
@@ -253,6 +255,12 @@ app.set = function(setting, val){
     return this.settings[setting];
   } else {
     this.settings[setting] = val;
+
+    if (setting === 'trust proxy') {
+      debug('compile trust proxy %j', val);
+      this.set('trust proxy fn', compileTrust(val));
+    }
+
     return this;
   }
 };
diff --git a/lib/request.js b/lib/request.js
index 34575ee2..dac29ee4 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -9,6 +9,7 @@ var http = require('http')
   , fresh = require('fresh')
   , parseRange = require('range-parser')
   , parse = require('parseurl')
+  , proxyaddr = require('proxy-addr')
   , mime = connect.mime;
 
 /**
@@ -337,19 +338,26 @@ req.is = function(type){
 /**
  * Return the protocol string "http" or "https"
  * when requested with TLS. When the "trust proxy"
- * setting is enabled the "X-Forwarded-Proto" header
- * field will be trusted. If you're running behind
- * a reverse proxy that supplies https for you this
- * may be enabled.
+ * setting trusts the socket address, the
+ * "X-Forwarded-Proto" header field will be trusted.
+ * If you're running behind a reverse proxy that
+ * supplies https for you this may be enabled.
  *
  * @return {String}
  * @api public
  */
 
 req.__defineGetter__('protocol', function(){
-  var trustProxy = this.app.get('trust proxy');
-  if (this.connection.encrypted) return 'https';
-  if (!trustProxy) return 'http';
+  var trust = this.app.get('trust proxy fn');
+
+  if (!trust(this.connection.remoteAddress)) {
+    return this.connection.encrypted
+      ? 'https'
+      : 'http';
+  }
+
+  // Note: X-Forwarded-Proto is normally only ever a
+  //       single value, but this is to be safe.
   var proto = this.get('X-Forwarded-Proto') || 'http';
   return proto.split(/\s*,\s*/)[0];
 });
@@ -368,36 +376,36 @@ req.__defineGetter__('secure', function(){
 });
 
 /**
- * Return the remote address, or when
- * "trust proxy" is `true` return
- * the upstream addr.
+ * Return the remote address from the trusted proxy.
+ *
+ * The is the remote address on the socket unless
+ * "trust proxy" is set.
  *
  * @return {String}
  * @api public
  */
 
 req.__defineGetter__('ip', function(){
-  return this.ips[0] || this.connection.remoteAddress;
+  var trust = this.app.get('trust proxy fn');
+  return proxyaddr(this, trust);
 });
 
 /**
- * When "trust proxy" is `true`, parse
- * the "X-Forwarded-For" ip address list.
+ * When "trust proxy" is set, trusted proxy addresses + client.
  *
  * For example if the value were "client, proxy1, proxy2"
  * you would receive the array `["client", "proxy1", "proxy2"]`
- * where "proxy2" is the furthest down-stream.
+ * where "proxy2" is the furthest down-stream and "proxy1" and
+ * "proxy2" were trusted.
  *
  * @return {Array}
  * @api public
  */
 
 req.__defineGetter__('ips', function(){
-  var trustProxy = this.app.get('trust proxy');
-  var val = this.get('X-Forwarded-For');
-  return trustProxy && val
-    ? val.split(/ *, */)
-    : [];
+  var trust = this.app.get('trust proxy fn');
+  var addrs = proxyaddr.all(this, trust);
+  return addrs.slice(1).reverse();
 });
 
 /**
@@ -467,19 +475,30 @@ req.__defineGetter__('path', function(){
 /**
  * Parse the "Host" header field hostname.
  *
+ * When the "trust proxy" setting trusts the socket
+ * address, the "X-Forwarded-Host" header field will
+ * be trusted.
+ *
  * @return {String}
  * @api public
  */
 
 req.__defineGetter__('host', function(){
-  var trustProxy = this.app.get('trust proxy');
-  var host = trustProxy && this.get('X-Forwarded-Host');
-  host = host || this.get('Host');
+  var trust = this.app.get('trust proxy fn');
+  var host = this.get('X-Forwarded-Host');
+
+  if (!host || !trust(this.connection.remoteAddress)) {
+    host = this.get('Host');
+  }
+
   if (!host) return;
+
+  // IPv6 literal support
   var offset = host[0] === '['
     ? host.indexOf(']') + 1
     : 0;
   var index = host.indexOf(':', offset);
+
   return ~index
     ? host.substring(0, index)
     : host;
diff --git a/lib/utils.js b/lib/utils.js
index 74d86258..d9dff89d 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -5,6 +5,7 @@
 
 var mime = require('connect').mime
   , deprecate = require('util').deprecate
+  , proxyaddr = require('proxy-addr')
   , crc32 = require('buffer-crc32');
 
 /**
@@ -337,3 +338,32 @@ exports.pathRegexp = function(path, keys, sensitive, strict) {
     .replace(/\*/g, '(.*)');
   return new RegExp('^' + path + '$', sensitive ? '' : 'i');
 }
+
+/**
+ * Compile "proxy trust" value to function.
+ *
+ * @param  {Boolean|String|Number|Array|Function} val
+ * @return {Function}
+ * @api private
+ */
+
+exports.compileTrust = function(val) {
+  if (typeof val === 'function') return val;
+
+  if (val === true) {
+    // Support plain true/false
+    return function(){ return true };
+  }
+
+  if (typeof val === 'number') {
+    // Support trusting hop count
+    return function(a, i){ return i < val };
+  }
+
+  if (typeof val === 'string') {
+    // Support comma-separated values
+    val = val.split(/ *, */);
+  }
+
+  return proxyaddr.compile(val || []);
+}
diff --git a/package.json b/package.json
index dea6c3e1..f8f9fd1d 100644
--- a/package.json
+++ b/package.json
@@ -39,6 +39,7 @@
     "methods": "1.0.0",
     "mkdirp": "0.5.0",
     "parseurl": "1.0.1",
+    "proxy-addr": "1.0.0",
     "range-parser": "1.0.0",
     "cookie": "0.1.2",
     "buffer-crc32": "0.2.1",
diff --git a/test/req.host.js b/test/req.host.js
index 5885a1a9..fdb3d492 100644
--- a/test/req.host.js
+++ b/test/req.host.js
@@ -69,5 +69,70 @@ describe('req', function(){
       .set('Host', '[::1]:3000')
       .expect('[::1]', done);
     })
+
+    describe('when "trust proxy" is enabled', function(){
+      it('should respect X-Forwarded-Host', function(done){
+        var app = express();
+
+        app.enable('trust proxy');
+
+        app.use(function(req, res){
+          res.end(req.host);
+        });
+
+        request(app)
+        .get('/')
+        .set('Host', 'localhost')
+        .set('X-Forwarded-Host', 'example.com')
+        .expect('example.com', done);
+      })
+
+      it('should ignore X-Forwarded-Host if socket addr not trusted', function(done){
+        var app = express();
+
+        app.set('trust proxy', '10.0.0.1');
+
+        app.use(function(req, res){
+          res.end(req.host);
+        });
+
+        request(app)
+        .get('/')
+        .set('Host', 'localhost')
+        .set('X-Forwarded-Host', 'example.com')
+        .expect('localhost', done);
+      })
+
+      it('should default to Host', function(done){
+        var app = express();
+
+        app.enable('trust proxy');
+
+        app.use(function(req, res){
+          res.end(req.host);
+        });
+
+        request(app)
+        .get('/')
+        .set('Host', 'example.com')
+        .expect('example.com', done);
+      })
+    })
+
+    describe('when "trust proxy" is disabled', function(){
+      it('should ignore X-Forwarded-Host', function(done){
+        var app = express();
+
+        app.use(function(req, res){
+          res.end(req.host);
+        });
+
+        request(app)
+        .get('/')
+        .set('Host', 'localhost')
+        .set('X-Forwarded-Host', 'evil')
+        .expect('localhost', done);
+      })
+    })
   })
 })
diff --git a/test/req.ip.js b/test/req.ip.js
index 473844a9..fd710d7e 100644
--- a/test/req.ip.js
+++ b/test/req.ip.js
@@ -20,6 +20,21 @@ describe('req', function(){
           .set('X-Forwarded-For', 'client, p1, p2')
           .expect('client', done);
         })
+
+        it('should return the addr after trusted proxy', function(done){
+          var app = express();
+
+          app.set('trust proxy', 2);
+
+          app.use(function(req, res, next){
+            res.send(req.ip);
+          });
+
+          request(app)
+          .get('/')
+          .set('X-Forwarded-For', 'client, p1, p2')
+          .expect('p1', done);
+        })
       })
 
       describe('when "trust proxy" is disabled', function(){
diff --git a/test/req.ips.js b/test/req.ips.js
index b34ca909..457e9b7c 100644
--- a/test/req.ips.js
+++ b/test/req.ips.js
@@ -20,6 +20,21 @@ describe('req', function(){
           .set('X-Forwarded-For', 'client, p1, p2')
           .expect('["client","p1","p2"]', done);
         })
+
+        it('should stop at first untrusted', function(done){
+          var app = express();
+
+          app.set('trust proxy', 2);
+
+          app.use(function(req, res, next){
+            res.send(req.ips);
+          });
+
+          request(app)
+          .get('/')
+          .set('X-Forwarded-For', 'client, p1, p2')
+          .expect('["p1","p2"]', done);
+        })
       })
 
       describe('when "trust proxy" is disabled', function(){
diff --git a/test/req.protocol.js b/test/req.protocol.js
index d25671fe..9da22d0b 100644
--- a/test/req.protocol.js
+++ b/test/req.protocol.js
@@ -32,6 +32,21 @@ describe('req', function(){
         .expect('https', done);
       })
 
+      it('should ignore X-Forwarded-Proto if socket addr not trusted', function(done){
+        var app = express();
+
+        app.set('trust proxy', '10.0.0.1');
+
+        app.use(function(req, res){
+          res.end(req.protocol);
+        });
+
+        request(app)
+        .get('/')
+        .set('X-Forwarded-Proto', 'https')
+        .expect('http', done);
+      })
+
       it('should default to http', function(done){
         var app = express();
 

From 328c6d30603202cfdf1e479f2486e10521a91a44 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Wed, 5 Mar 2014 22:06:14 -0800
Subject: [PATCH 04/13] remove unnecessary test/support/http

backport of 643397ed21fc7086dc5662d1f291beddfbb976ae
---
 test/Router.js                         |  2 +-
 test/acceptance/auth.js                |  2 +-
 test/acceptance/content-negotiation.js |  2 +-
 test/acceptance/cookies.js             |  2 +-
 test/acceptance/downloads.js           |  2 +-
 test/acceptance/ejs.js                 |  2 +-
 test/acceptance/error-pages.js         |  2 +-
 test/acceptance/error.js               |  2 +-
 test/acceptance/markdown.js            |  2 +-
 test/acceptance/mvc.js                 |  2 +-
 test/acceptance/params.js              |  2 +-
 test/acceptance/resource.js            |  2 +-
 test/acceptance/web-service.js         |  2 +-
 test/app.all.js                        |  2 +-
 test/app.del.js                        |  2 +-
 test/app.head.js                       |  6 ++--
 test/app.listen.js                     |  2 +-
 test/app.locals.js                     |  4 +--
 test/app.options.js                    |  4 +--
 test/app.param.js                      |  2 +-
 test/app.request.js                    |  2 +-
 test/app.response.js                   |  6 ++--
 test/app.routes.error.js               |  2 +-
 test/app.routes.js                     |  2 +-
 test/app.use.js                        |  4 +--
 test/exports.js                        |  6 ++--
 test/middleware.basic.js               |  2 +-
 test/regression.js                     |  2 +-
 test/req.accepted.js                   |  2 +-
 test/req.acceptedCharsets.js           |  2 +-
 test/req.acceptedEncodings.js          |  2 +-
 test/req.acceptedLanguages.js          |  2 +-
 test/req.accepts.js                    |  2 +-
 test/req.acceptsCharset.js             |  2 +-
 test/req.auth.js                       |  2 +-
 test/req.fresh.js                      |  2 +-
 test/req.get.js                        |  2 +-
 test/req.host.js                       |  2 +-
 test/req.ip.js                         |  2 +-
 test/req.ips.js                        |  2 +-
 test/req.is.js                         |  2 +-
 test/req.param.js                      |  6 ++--
 test/req.path.js                       |  2 +-
 test/req.protocol.js                   |  2 +-
 test/req.query.js                      |  4 +--
 test/req.route.js                      |  4 +--
 test/req.secure.js                     |  2 +-
 test/req.signedCookies.js              |  2 +-
 test/req.stale.js                      |  2 +-
 test/req.subdomains.js                 |  2 +-
 test/req.xhr.js                        |  8 ++---
 test/res.attachment.js                 |  6 ++--
 test/res.charset.js                    |  4 +--
 test/res.clearCookie.js                |  4 +--
 test/res.cookie.js                     |  8 ++---
 test/res.download.js                   |  2 +-
 test/res.format.js                     |  4 +--
 test/res.json.js                       |  2 +-
 test/res.jsonp.js                      |  2 +-
 test/res.locals.js                     |  2 +-
 test/res.location.js                   |  2 +-
 test/res.redirect.js                   |  2 +-
 test/res.render.js                     | 50 +++++++++++++-------------
 test/res.send.js                       |  2 +-
 test/res.sendfile.js                   |  2 +-
 test/res.set.js                        |  4 +--
 test/res.status.js                     |  2 +-
 test/res.type.js                       |  2 +-
 test/support/http.js                   |  2 --
 69 files changed, 117 insertions(+), 119 deletions(-)
 delete mode 100644 test/support/http.js

diff --git a/test/Router.js b/test/Router.js
index 5bb49753..34a799fa 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -1,7 +1,7 @@
 
 var express = require('../')
   , Router = express.Router
-  , request = require('./support/http')
+  , request = require('supertest')
   , methods = require('methods')
   , assert = require('assert');
 
diff --git a/test/acceptance/auth.js b/test/acceptance/auth.js
index f8ec6a89..7f884df0 100644
--- a/test/acceptance/auth.js
+++ b/test/acceptance/auth.js
@@ -1,5 +1,5 @@
 var app = require('../../examples/auth/app')
-  , request = require('../support/http');
+  , request = require('supertest');
 
 function redirects(to, fn){
   return function(err, res){
diff --git a/test/acceptance/content-negotiation.js b/test/acceptance/content-negotiation.js
index 3c929293..99842585 100644
--- a/test/acceptance/content-negotiation.js
+++ b/test/acceptance/content-negotiation.js
@@ -1,5 +1,5 @@
 
-var request = require('../support/http')
+var request = require('supertest')
   , app = require('../../examples/content-negotiation');
 
 describe('content-negotiation', function(){
diff --git a/test/acceptance/cookies.js b/test/acceptance/cookies.js
index 910c1218..d6d4f007 100644
--- a/test/acceptance/cookies.js
+++ b/test/acceptance/cookies.js
@@ -1,6 +1,6 @@
 
 var app = require('../../examples/cookies/app')
-  , request = require('../support/http');
+  , request = require('supertest');
 
 describe('cookies', function(){
   describe('GET /', function(){
diff --git a/test/acceptance/downloads.js b/test/acceptance/downloads.js
index 7e7b4da8..ab7082a0 100644
--- a/test/acceptance/downloads.js
+++ b/test/acceptance/downloads.js
@@ -1,6 +1,6 @@
 
 var app = require('../../examples/downloads/app')
-  , request = require('../support/http');
+  , request = require('supertest');
 
 describe('downloads', function(){
   describe('GET /', function(){
diff --git a/test/acceptance/ejs.js b/test/acceptance/ejs.js
index a9877901..b51c03be 100644
--- a/test/acceptance/ejs.js
+++ b/test/acceptance/ejs.js
@@ -1,5 +1,5 @@
 
-var request = require('../support/http')
+var request = require('supertest')
   , app = require('../../examples/ejs');
 
 describe('ejs', function(){
diff --git a/test/acceptance/error-pages.js b/test/acceptance/error-pages.js
index bc2e1031..886cedca 100644
--- a/test/acceptance/error-pages.js
+++ b/test/acceptance/error-pages.js
@@ -1,6 +1,6 @@
 
 var app = require('../../examples/error-pages')
-  , request = require('../support/http');
+  , request = require('supertest');
 
 describe('error-pages', function(){
   describe('GET /', function(){
diff --git a/test/acceptance/error.js b/test/acceptance/error.js
index b5dc97bf..6010f2e2 100644
--- a/test/acceptance/error.js
+++ b/test/acceptance/error.js
@@ -1,6 +1,6 @@
 
 var app = require('../../examples/error')
-  , request = require('../support/http');
+  , request = require('supertest');
 
 describe('error', function(){
   describe('GET /', function(){
diff --git a/test/acceptance/markdown.js b/test/acceptance/markdown.js
index d086992b..8c788e35 100644
--- a/test/acceptance/markdown.js
+++ b/test/acceptance/markdown.js
@@ -1,6 +1,6 @@
 
 var app = require('../../examples/markdown')
-  , request = require('../support/http');
+  , request = require('supertest');
 
 describe('markdown', function(){
   describe('GET /', function(){
diff --git a/test/acceptance/mvc.js b/test/acceptance/mvc.js
index 031216f0..3386d833 100644
--- a/test/acceptance/mvc.js
+++ b/test/acceptance/mvc.js
@@ -1,5 +1,5 @@
 
-var request = require('../support/http')
+var request = require('supertest')
   , app = require('../../examples/mvc');
 
 describe('mvc', function(){
diff --git a/test/acceptance/params.js b/test/acceptance/params.js
index f6c449ff..f9663244 100644
--- a/test/acceptance/params.js
+++ b/test/acceptance/params.js
@@ -1,5 +1,5 @@
 var app = require('../../examples/params/app')
-  , request = require('../support/http');
+  , request = require('supertest');
 
 describe('params', function(){
   describe('GET /', function(){
diff --git a/test/acceptance/resource.js b/test/acceptance/resource.js
index c235fabe..8ab2331c 100644
--- a/test/acceptance/resource.js
+++ b/test/acceptance/resource.js
@@ -1,5 +1,5 @@
 var app = require('../../examples/resource/app')
-  , request = require('../support/http');
+  , request = require('supertest');
 
 describe('resource', function(){
   describe('GET /', function(){
diff --git a/test/acceptance/web-service.js b/test/acceptance/web-service.js
index 50acddd9..67e9b44a 100644
--- a/test/acceptance/web-service.js
+++ b/test/acceptance/web-service.js
@@ -1,5 +1,5 @@
 
-var request = require('../support/http')
+var request = require('supertest')
   , app = require('../../examples/web-service');
 
 describe('web-service', function(){
diff --git a/test/app.all.js b/test/app.all.js
index 14720850..a0c68d42 100644
--- a/test/app.all.js
+++ b/test/app.all.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app.all()', function(){
   it('should add a router per method', function(done){
diff --git a/test/app.del.js b/test/app.del.js
index ad12199c..d419fbb1 100644
--- a/test/app.del.js
+++ b/test/app.del.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app.del()', function(){
   it('should alias app.delete()', function(done){
diff --git a/test/app.head.js b/test/app.head.js
index a37c47bf..41e12916 100644
--- a/test/app.head.js
+++ b/test/app.head.js
@@ -1,7 +1,7 @@
 
-var express = require('../')
-  , request = require('./support/http')
-  , assert = require('assert');
+var express = require('../');
+var request = require('supertest');
+var assert = require('assert');
 
 describe('HEAD', function(){
   it('should default to GET', function(done){
diff --git a/test/app.listen.js b/test/app.listen.js
index 691e1a9c..b6f68578 100644
--- a/test/app.listen.js
+++ b/test/app.listen.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app.listen()', function(){
   it('should wrap with an HTTP server', function(done){
diff --git a/test/app.locals.js b/test/app.locals.js
index 58ccb854..afe9922f 100644
--- a/test/app.locals.js
+++ b/test/app.locals.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app', function(){
   describe('.locals(obj)', function(){
@@ -14,7 +14,7 @@ describe('app', function(){
       app.locals.age.should.equal(2);
     })
   })
-  
+
   describe('.locals.settings', function(){
     it('should expose app settings', function(){
       var app = express();
diff --git a/test/app.options.js b/test/app.options.js
index a6f7b65f..9a9852a7 100644
--- a/test/app.options.js
+++ b/test/app.options.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('OPTIONS', function(){
   it('should default to the routes defined', function(done){
@@ -58,4 +58,4 @@ describe('app.options()', function(){
     .expect('GET')
     .expect('Allow', 'GET', done);
   })
-})
\ No newline at end of file
+})
diff --git a/test/app.param.js b/test/app.param.js
index 98332b5d..6f0ee8e7 100644
--- a/test/app.param.js
+++ b/test/app.param.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app', function(){
   describe('.param(fn)', function(){
diff --git a/test/app.request.js b/test/app.request.js
index 6d311128..728043a5 100644
--- a/test/app.request.js
+++ b/test/app.request.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app', function(){
   describe('.request', function(){
diff --git a/test/app.response.js b/test/app.response.js
index 84911e4c..c6ea77c8 100644
--- a/test/app.response.js
+++ b/test/app.response.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app', function(){
   describe('.response', function(){
@@ -19,7 +19,7 @@ describe('app', function(){
       .get('/')
       .expect('HEY', done);
     })
-    
+
     it('should not be influenced by other app protos', function(done){
       var app = express()
         , app2 = express();
@@ -27,7 +27,7 @@ describe('app', function(){
       app.response.shout = function(str){
         this.send(str.toUpperCase());
       };
-      
+
       app2.response.shout = function(str){
         this.send(str);
       };
diff --git a/test/app.routes.error.js b/test/app.routes.error.js
index d76bb2eb..ac517efd 100644
--- a/test/app.routes.error.js
+++ b/test/app.routes.error.js
@@ -1,5 +1,5 @@
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app', function(){
   describe('.VERB()', function(){
diff --git a/test/app.routes.js b/test/app.routes.js
index a559ce8d..ff117565 100644
--- a/test/app.routes.js
+++ b/test/app.routes.js
@@ -1,7 +1,7 @@
 
 var express = require('../')
   , assert = require('assert')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app.routes', function(){
   it('should be initialized', function(){
diff --git a/test/app.use.js b/test/app.use.js
index 20a52966..d627bdfe 100644
--- a/test/app.use.js
+++ b/test/app.use.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app', function(){
   it('should emit "mount" when mounted', function(done){
@@ -23,7 +23,7 @@ describe('app', function(){
       blog.get('/blog', function(req, res){
         res.end('blog');
       });
-      
+
       app.use(blog);
 
       request(app)
diff --git a/test/exports.js b/test/exports.js
index 8384d95a..34ce505d 100644
--- a/test/exports.js
+++ b/test/exports.js
@@ -1,7 +1,7 @@
 
-var express = require('../')
-  , request = require('./support/http')
-  , assert = require('assert');
+var express = require('../');
+var request = require('supertest');
+var assert = require('assert');
 
 describe('exports', function(){
   it('should expose connect middleware', function(){
diff --git a/test/middleware.basic.js b/test/middleware.basic.js
index 448d4779..c3c6f1bb 100644
--- a/test/middleware.basic.js
+++ b/test/middleware.basic.js
@@ -1,6 +1,6 @@
 // 
 // var express = require('../')
-//   , request = require('./support/http');
+//   , request = require('supertest');
 // 
 // describe('middleware', function(){
 //   describe('.next()', function(){
diff --git a/test/regression.js b/test/regression.js
index fdb2c5f5..5d4509ed 100644
--- a/test/regression.js
+++ b/test/regression.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('throw after .end()', function(){
   it('should fail gracefully', function(done){
diff --git a/test/req.accepted.js b/test/req.accepted.js
index 79f122a8..5a9ec3f1 100644
--- a/test/req.accepted.js
+++ b/test/req.accepted.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.accepted', function(){
diff --git a/test/req.acceptedCharsets.js b/test/req.acceptedCharsets.js
index 2bc3e0d9..8109abec 100644
--- a/test/req.acceptedCharsets.js
+++ b/test/req.acceptedCharsets.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.acceptedCharsets', function(){
diff --git a/test/req.acceptedEncodings.js b/test/req.acceptedEncodings.js
index 50ac9c2d..49bf61c8 100644
--- a/test/req.acceptedEncodings.js
+++ b/test/req.acceptedEncodings.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.acceptedEncodings', function(){
diff --git a/test/req.acceptedLanguages.js b/test/req.acceptedLanguages.js
index 9325d955..5e2f169b 100644
--- a/test/req.acceptedLanguages.js
+++ b/test/req.acceptedLanguages.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.acceptedLanguages', function(){
diff --git a/test/req.accepts.js b/test/req.accepts.js
index a8fc13b5..1e1e0d76 100644
--- a/test/req.accepts.js
+++ b/test/req.accepts.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.accepts(type)', function(){
diff --git a/test/req.acceptsCharset.js b/test/req.acceptsCharset.js
index 1db237d4..0d0ed8b5 100644
--- a/test/req.acceptsCharset.js
+++ b/test/req.acceptsCharset.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.acceptsCharset(type)', function(){
diff --git a/test/req.auth.js b/test/req.auth.js
index eac1f4ec..60bec2d3 100644
--- a/test/req.auth.js
+++ b/test/req.auth.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.auth', function(){
diff --git a/test/req.fresh.js b/test/req.fresh.js
index e0079bb9..68912b88 100644
--- a/test/req.fresh.js
+++ b/test/req.fresh.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.fresh', function(){
diff --git a/test/req.get.js b/test/req.get.js
index 6e114509..144a2568 100644
--- a/test/req.get.js
+++ b/test/req.get.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , assert = require('assert');
 
 describe('req', function(){
diff --git a/test/req.host.js b/test/req.host.js
index fdb3d492..66cfff4e 100644
--- a/test/req.host.js
+++ b/test/req.host.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , assert = require('assert');
 
 describe('req', function(){
diff --git a/test/req.ip.js b/test/req.ip.js
index fd710d7e..8e5f9f55 100644
--- a/test/req.ip.js
+++ b/test/req.ip.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.ip', function(){
diff --git a/test/req.ips.js b/test/req.ips.js
index 457e9b7c..a7d464b8 100644
--- a/test/req.ips.js
+++ b/test/req.ips.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.ips', function(){
diff --git a/test/req.is.js b/test/req.is.js
index b51e6c81..24f3bd50 100644
--- a/test/req.is.js
+++ b/test/req.is.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 function req(ct) {
   var req = {
diff --git a/test/req.param.js b/test/req.param.js
index e26257d4..bea8d4ca 100644
--- a/test/req.param.js
+++ b/test/req.param.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest')
 
 describe('req', function(){
   describe('.param(name, default)', function(){
@@ -29,7 +29,7 @@ describe('req', function(){
       .get('/?name=tj')
       .expect('tj', done);
     })
-    
+
     it('should check req.body', function(done){
       var app = express();
 
@@ -44,7 +44,7 @@ describe('req', function(){
       .send({ name: 'tj' })
       .expect('tj', done);
     })
-    
+
     it('should check req.params', function(done){
       var app = express();
 
diff --git a/test/req.path.js b/test/req.path.js
index f12df375..6ad4009c 100644
--- a/test/req.path.js
+++ b/test/req.path.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.path', function(){
diff --git a/test/req.protocol.js b/test/req.protocol.js
index 9da22d0b..9a44aeb5 100644
--- a/test/req.protocol.js
+++ b/test/req.protocol.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.protocol', function(){
diff --git a/test/req.query.js b/test/req.query.js
index 53d24400..10547e4a 100644
--- a/test/req.query.js
+++ b/test/req.query.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.query', function(){
@@ -18,7 +18,7 @@ describe('req', function(){
         done();
       });
     })
-    
+
     it('should contain the parsed query-string', function(done){
       var app = express();
 
diff --git a/test/req.route.js b/test/req.route.js
index 329f85ef..31ab6a86 100644
--- a/test/req.route.js
+++ b/test/req.route.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.route', function(){
@@ -12,7 +12,7 @@ describe('req', function(){
         req.route.path.should.equal('/user/:id/:op?');
         next();
       });
-      
+
       app.get('/user/:id/edit', function(req, res){
         req.route.method.should.equal('get');
         req.route.path.should.equal('/user/:id/edit');
diff --git a/test/req.secure.js b/test/req.secure.js
index 6c59a898..df9ae93f 100644
--- a/test/req.secure.js
+++ b/test/req.secure.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.secure', function(){
diff --git a/test/req.signedCookies.js b/test/req.signedCookies.js
index d9f8c594..467a3aee 100644
--- a/test/req.signedCookies.js
+++ b/test/req.signedCookies.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest')
 
 describe('req', function(){
   describe('.signedCookies', function(){
diff --git a/test/req.stale.js b/test/req.stale.js
index 22262836..2c55e8b9 100644
--- a/test/req.stale.js
+++ b/test/req.stale.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.stale', function(){
diff --git a/test/req.subdomains.js b/test/req.subdomains.js
index ff48dbb3..ec851d2c 100644
--- a/test/req.subdomains.js
+++ b/test/req.subdomains.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.subdomains', function(){
diff --git a/test/req.xhr.js b/test/req.xhr.js
index 8c7b56d0..fe4c0503 100644
--- a/test/req.xhr.js
+++ b/test/req.xhr.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.xhr', function(){
@@ -19,7 +19,7 @@ describe('req', function(){
         done();
       })
     })
-    
+
     it('should case-insensitive', function(done){
       var app = express();
 
@@ -35,7 +35,7 @@ describe('req', function(){
         done();
       })
     })
-    
+
     it('should return false otherwise', function(done){
       var app = express();
 
@@ -51,7 +51,7 @@ describe('req', function(){
         done();
       })
     })
-    
+
     it('should return false when not present', function(done){
       var app = express();
 
diff --git a/test/res.attachment.js b/test/res.attachment.js
index aea5eb16..1049b07c 100644
--- a/test/res.attachment.js
+++ b/test/res.attachment.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.attachment()', function(){
@@ -16,7 +16,7 @@ describe('res', function(){
       .expect('Content-Disposition', 'attachment', done);
     })
   })
-  
+
   describe('.attachment(filename)', function(){
     it('should add the filename param', function(done){
       var app = express();
@@ -30,7 +30,7 @@ describe('res', function(){
       .get('/')
       .expect('Content-Disposition', 'attachment; filename="image.png"', done);
     })
-    
+
     it('should set the Content-Type', function(done){
       var app = express();
 
diff --git a/test/res.charset.js b/test/res.charset.js
index 79ec3dfb..2403ba4d 100644
--- a/test/res.charset.js
+++ b/test/res.charset.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.charset', function(){
@@ -17,7 +17,7 @@ describe('res', function(){
       .get('/')
       .expect("text/x-foo; charset=utf-8", done);
     })
-    
+
     it('should take precedence over res.send() defaults', function(done){
       var app = express();
 
diff --git a/test/res.clearCookie.js b/test/res.clearCookie.js
index 99c56c0c..92c9d049 100644
--- a/test/res.clearCookie.js
+++ b/test/res.clearCookie.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.clearCookie(name)', function(){
@@ -20,7 +20,7 @@ describe('res', function(){
       })
     })
   })
-  
+
   describe('.clearCookie(name, options)', function(){
     it('should set the given params', function(done){
       var app = express();
diff --git a/test/res.cookie.js b/test/res.cookie.js
index d671def3..a322b1d7 100644
--- a/test/res.cookie.js
+++ b/test/res.cookie.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , utils = require('connect').utils
   , cookie = require('cookie');
 
@@ -39,7 +39,7 @@ describe('res', function(){
         done();
       })
     })
-    
+
     it('should allow multiple calls', function(done){
       var app = express();
 
@@ -58,7 +58,7 @@ describe('res', function(){
       })
     })
   })
-  
+
   describe('.cookie(name, string, options)', function(){
     it('should set params', function(done){
       var app = express();
@@ -76,7 +76,7 @@ describe('res', function(){
         done();
       })
     })
-    
+
     describe('maxAge', function(){
       it('should set relative expires', function(done){
         var app = express();
diff --git a/test/res.download.js b/test/res.download.js
index a78f8d20..614e4320 100644
--- a/test/res.download.js
+++ b/test/res.download.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , assert = require('assert');
 
 describe('res', function(){
diff --git a/test/res.format.js b/test/res.format.js
index 4cf63647..be1e6cbb 100644
--- a/test/res.format.js
+++ b/test/res.format.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , utils = require('../lib/utils')
   , assert = require('assert');
 
@@ -15,7 +15,7 @@ app1.use(function(req, res, next){
     'text/html': function(){
       res.send('<p>hey</p>');
     },
-  
+
     'application/json': function(a, b, c){
       assert(req == a);
       assert(res == b);
diff --git a/test/res.json.js b/test/res.json.js
index 02eb5166..9cefe259 100644
--- a/test/res.json.js
+++ b/test/res.json.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , assert = require('assert');
 
 describe('res', function(){
diff --git a/test/res.jsonp.js b/test/res.jsonp.js
index eaa11559..03087ec4 100644
--- a/test/res.jsonp.js
+++ b/test/res.jsonp.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , assert = require('assert');
 
 describe('res', function(){
diff --git a/test/res.locals.js b/test/res.locals.js
index 6cc4049f..4bf1efa1 100644
--- a/test/res.locals.js
+++ b/test/res.locals.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.locals(obj)', function(){
diff --git a/test/res.location.js b/test/res.location.js
index b9810d31..48697d02 100644
--- a/test/res.location.js
+++ b/test/res.location.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.location(url)', function(){
diff --git a/test/res.redirect.js b/test/res.redirect.js
index 4640719c..f13a070c 100644
--- a/test/res.redirect.js
+++ b/test/res.redirect.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.redirect(url)', function(){
diff --git a/test/res.render.js b/test/res.render.js
index a865929f..db38752c 100644
--- a/test/res.render.js
+++ b/test/res.render.js
@@ -1,12 +1,12 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.render(name)', function(){
     it('should support absolute paths', function(done){
       var app = express();
-  
+
       app.locals.user = { name: 'tobi' };
 
       app.use(function(req, res){
@@ -17,10 +17,10 @@ describe('res', function(){
       .get('/')
       .expect('<p>tobi</p>', done);
     })
-    
+
     it('should support absolute paths with "view engine"', function(done){
       var app = express();
-  
+
       app.locals.user = { name: 'tobi' };
       app.set('view engine', 'jade');
 
@@ -35,7 +35,7 @@ describe('res', function(){
 
     it('should expose app.locals', function(done){
       var app = express();
-  
+
       app.set('views', __dirname + '/fixtures');
       app.locals.user = { name: 'tobi' };
 
@@ -50,29 +50,29 @@ describe('res', function(){
   
     it('should support index.<engine>', function(done){
       var app = express();
-  
+
       app.set('views', __dirname + '/fixtures');
       app.set('view engine', 'jade');
 
       app.use(function(req, res){
         res.render('blog/post');
       });
-      
+
       request(app)
       .get('/')
       .expect('<h1>blog post</h1>', done);
     })
-  
+
     describe('when an error occurs', function(){
       it('should next(err)', function(done){
         var app = express();
-  
+
         app.set('views', __dirname + '/fixtures');
 
         app.use(function(req, res){
           res.render('user.jade');
         });
-        
+
         app.use(function(err, req, res, next){
           res.end(err.message);
         });
@@ -82,11 +82,11 @@ describe('res', function(){
         .expect(/user is not defined/, done);
       })
     })
-  
+
     describe('when "view engine" is given', function(){
       it('should render the template', function(done){
         var app = express();
-  
+
         app.set('view engine', 'jade');
         app.set('views', __dirname + '/fixtures');
 
@@ -104,9 +104,9 @@ describe('res', function(){
   describe('.render(name, option)', function(){
     it('should render the template', function(done){
       var app = express();
-  
+
       app.set('views', __dirname + '/fixtures');
-  
+
       var user = { name: 'tobi' };
 
       app.use(function(req, res){
@@ -117,10 +117,10 @@ describe('res', function(){
       .get('/')
       .expect('<p>tobi</p>', done);
     })
-  
+
     it('should expose app.locals', function(done){
       var app = express();
-    
+
       app.set('views', __dirname + '/fixtures');
       app.locals.user = { name: 'tobi' };
 
@@ -132,10 +132,10 @@ describe('res', function(){
       .get('/')
       .expect('<p>tobi</p>', done);
     })
-    
+
     it('should expose res.locals', function(done){
       var app = express();
-    
+
       app.set('views', __dirname + '/fixtures');
 
       app.use(function(req, res){
@@ -147,10 +147,10 @@ describe('res', function(){
       .get('/')
       .expect('<p>tobi</p>', done);
     })
-    
+
     it('should give precedence to res.locals over app.locals', function(done){
       var app = express();
-    
+
       app.set('views', __dirname + '/fixtures');
       app.locals.user = { name: 'tobi' };
 
@@ -166,10 +166,10 @@ describe('res', function(){
 
     it('should give precedence to res.render() locals over res.locals', function(done){
       var app = express();
-    
+
       app.set('views', __dirname + '/fixtures');
       var jane = { name: 'jane' };
-    
+
       app.use(function(req, res){
         res.locals.user = { name: 'tobi' };
         res.render('user.jade', { user: jane });
@@ -179,14 +179,14 @@ describe('res', function(){
       .get('/')
       .expect('<p>jane</p>', done);
     })
-    
+
     it('should give precedence to res.render() locals over app.locals', function(done){
       var app = express();
-    
+
       app.set('views', __dirname + '/fixtures');
       app.locals.user = { name: 'tobi' };
       var jane = { name: 'jane' };
-    
+
       app.use(function(req, res){
         res.render('user.jade', { user: jane });
       });
diff --git a/test/res.send.js b/test/res.send.js
index 8f631593..98d4b875 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , assert = require('assert');
 
 describe('res', function(){
diff --git a/test/res.sendfile.js b/test/res.sendfile.js
index 5532a5a5..b6ec9833 100644
--- a/test/res.sendfile.js
+++ b/test/res.sendfile.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , assert = require('assert');
 
 describe('res', function(){
diff --git a/test/res.set.js b/test/res.set.js
index 152efd35..76dcf7fe 100644
--- a/test/res.set.js
+++ b/test/res.set.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , res = express.response;
 
 describe('res', function(){
@@ -45,7 +45,7 @@ describe('res', function(){
       JSON.stringify(res.get('ETag')).should.equal('["123","456"]');
     })
   })
-  
+
   describe('.set(object)', function(){
     it('should set multiple fields', function(done){
       var app = express();
diff --git a/test/res.status.js b/test/res.status.js
index 0de25eb7..8c173a64 100644
--- a/test/res.status.js
+++ b/test/res.status.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.status(code)', function(){
diff --git a/test/res.type.js b/test/res.type.js
index 09653e39..7c03ef4c 100644
--- a/test/res.type.js
+++ b/test/res.type.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.type(str)', function(){
diff --git a/test/support/http.js b/test/support/http.js
deleted file mode 100644
index 382e63ce..00000000
--- a/test/support/http.js
+++ /dev/null
@@ -1,2 +0,0 @@
-
-module.exports = require('supertest');
\ No newline at end of file

From 1717516a7832df763b3dc8dfdf98c4fc5498f348 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 18 May 2014 01:13:12 -0400
Subject: [PATCH 05/13] build: improve platform portability

---
 .travis.yml         | 1 +
 Readme.md           | 4 +++-
 package.json        | 3 ++-
 test/support/env.js | 2 ++
 4 files changed, 8 insertions(+), 2 deletions(-)
 create mode 100644 test/support/env.js

diff --git a/.travis.yml b/.travis.yml
index 65cf4bc2..bb47c1b0 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -7,3 +7,4 @@ matrix:
   allow_failures:
     - node_js: "0.11"
   fast_finish: true
+script: "npm run-script test-travis"
diff --git a/Readme.md b/Readme.md
index 360e7fbc..ffdd8c8c 100644
--- a/Readme.md
+++ b/Readme.md
@@ -94,7 +94,9 @@ To run the test suite, first invoke the following command within the repo, insta
 
 Then run the tests:
 
-    $ make test
+```sh
+$ npm test
+```
 
 ## Contributors
 
diff --git a/package.json b/package.json
index f8f9fd1d..b213eccc 100644
--- a/package.json
+++ b/package.json
@@ -78,7 +78,8 @@
   },
   "scripts": {
     "prepublish": "npm prune",
-    "test": "make test"
+    "test": "mocha --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
+    "test-travis": "mocha --require test/support/env --reporter spec --check-leaks test/ test/acceptance/"
   },
   "engines": {
     "node": ">= 0.8.0"
diff --git a/test/support/env.js b/test/support/env.js
new file mode 100644
index 00000000..eb938f3b
--- /dev/null
+++ b/test/support/env.js
@@ -0,0 +1,2 @@
+
+process.env.NODE_ENV = 'test';

From 0f49d8062369f3782287e9e0209acbc2264ae61a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 18 May 2014 01:16:38 -0400
Subject: [PATCH 06/13] build: clean up package file

---
 package.json | 35 +++++++++++++++++------------------
 1 file changed, 17 insertions(+), 18 deletions(-)

diff --git a/package.json b/package.json
index b213eccc..cfab8cd5 100644
--- a/package.json
+++ b/package.json
@@ -33,6 +33,19 @@
       "email": "shtylman+expressjs@gmail.com"
     }
   ],
+  "keywords": [
+    "express",
+    "framework",
+    "sinatra",
+    "web",
+    "rest",
+    "restful",
+    "router",
+    "app",
+    "api"
+  ],
+  "repository": "git://github.com/visionmedia/express",
+  "license": "MIT",
   "dependencies": {
     "connect": "2.16.1",
     "commander": "1.3.2",
@@ -60,19 +73,9 @@
     "marked": "0.2.10",
     "supertest": "~0.12.1"
   },
-  "keywords": [
-    "express",
-    "framework",
-    "sinatra",
-    "web",
-    "rest",
-    "restful",
-    "router",
-    "app",
-    "api"
-  ],
-  "repository": "git://github.com/visionmedia/express",
-  "main": "index",
+  "engines": {
+    "node": ">= 0.8.0"
+  },
   "bin": {
     "express": "./bin/express"
   },
@@ -80,9 +83,5 @@
     "prepublish": "npm prune",
     "test": "mocha --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
     "test-travis": "mocha --require test/support/env --reporter spec --check-leaks test/ test/acceptance/"
-  },
-  "engines": {
-    "node": ">= 0.8.0"
-  },
-  "license": "MIT"
+  }
 }

From 12da523ff7165ce6a2d0f50450d8e902f3b6ec87 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 18 May 2014 01:20:39 -0400
Subject: [PATCH 07/13] build: test coverage with istanbul

---
 .gitignore   |  5 +----
 .npmignore   |  3 +--
 Makefile     | 34 ----------------------------------
 package.json |  4 +++-
 4 files changed, 5 insertions(+), 41 deletions(-)
 delete mode 100644 Makefile

diff --git a/.gitignore b/.gitignore
index 8bbe1c83..e5deefa2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,5 @@
-coverage.html
+coverage/
 .DS_Store
-lib-cov
 *.seed
 *.log
 *.csv
@@ -13,7 +12,5 @@ benchmarks/graphs
 testing
 node_modules/
 testing
-.coverage_data
-cover_html
 test.js
 .idea
diff --git a/.npmignore b/.npmignore
index a9465cfb..8c029e8c 100644
--- a/.npmignore
+++ b/.npmignore
@@ -1,5 +1,6 @@
 .git*
 benchmarks/
+coverage/
 docs/
 examples/
 support/
@@ -7,5 +8,3 @@ test/
 testing.js
 .DS_Store
 .travis.yml
-coverage.html
-lib-cov
diff --git a/Makefile b/Makefile
deleted file mode 100644
index a1f33a70..00000000
--- a/Makefile
+++ /dev/null
@@ -1,34 +0,0 @@
-
-MOCHA_OPTS= --check-leaks
-REPORTER = dot
-
-check: test
-
-test: test-unit test-acceptance
-
-test-unit:
-	@NODE_ENV=test ./node_modules/.bin/mocha \
-		--reporter $(REPORTER) \
-		--globals setImmediate,clearImmediate \
-		$(MOCHA_OPTS)
-
-test-acceptance:
-	@NODE_ENV=test ./node_modules/.bin/mocha \
-		--reporter $(REPORTER) \
-		--bail \
-		test/acceptance/*.js
-
-test-cov: lib-cov
-	@EXPRESS_COV=1 $(MAKE) test REPORTER=html-cov > coverage.html
-
-lib-cov:
-	@jscoverage lib lib-cov
-
-bench:
-	@$(MAKE) -C benchmarks
-
-clean:
-	rm -f coverage.html
-	rm -fr lib-cov
-
-.PHONY: test test-unit test-acceptance bench clean
diff --git a/package.json b/package.json
index cfab8cd5..d225d000 100644
--- a/package.json
+++ b/package.json
@@ -64,6 +64,7 @@
   },
   "devDependencies": {
     "ejs": "~0.8.4",
+    "istanbul": "0.2.10",
     "mocha": "~1.18.2",
     "jade": "~0.30.0",
     "hjs": "~0.0.6",
@@ -82,6 +83,7 @@
   "scripts": {
     "prepublish": "npm prune",
     "test": "mocha --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
-    "test-travis": "mocha --require test/support/env --reporter spec --check-leaks test/ test/acceptance/"
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
+    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter spec --check-leaks test/ test/acceptance/"
   }
 }

From 1b3fb0af8c918f9f1400086c937b8c51ccf9f783 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 18 May 2014 01:25:15 -0400
Subject: [PATCH 08/13] build: add coverage reporting

---
 Readme.md    | 2 +-
 package.json | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/Readme.md b/Readme.md
index ffdd8c8c..2ce67204 100644
--- a/Readme.md
+++ b/Readme.md
@@ -2,7 +2,7 @@
 
   Fast, unopinionated, minimalist web framework for [node](http://nodejs.org).
 
-  [![Build Status](https://travis-ci.org/visionmedia/express.svg?branch=master)](https://travis-ci.org/visionmedia/express) [![Gittip](http://img.shields.io/gittip/visionmedia.svg)](https://www.gittip.com/visionmedia/) [![NPM version](https://badge.fury.io/js/express.svg)](http://badge.fury.io/js/express)
+  [![NPM version](https://badge.fury.io/js/express.svg)](http://badge.fury.io/js/express) [![Build Status](https://travis-ci.org/visionmedia/express.svg?branch=master)](https://travis-ci.org/visionmedia/express) [![Coverage Status](https://img.shields.io/coveralls/visionmedia/express.svg)](https://coveralls.io/r/visionmedia/express) [![Gittip](http://img.shields.io/gittip/visionmedia.svg)](https://www.gittip.com/visionmedia/)
 
 ```js
 var express = require('express');
diff --git a/package.json b/package.json
index d225d000..bf099970 100644
--- a/package.json
+++ b/package.json
@@ -63,6 +63,7 @@
     "debug": ">= 0.8.0 < 1"
   },
   "devDependencies": {
+    "coveralls": "2.10.0",
     "ejs": "~0.8.4",
     "istanbul": "0.2.10",
     "mocha": "~1.18.2",
@@ -84,6 +85,6 @@
     "prepublish": "npm prune",
     "test": "mocha --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
     "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
-    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter spec --check-leaks test/ test/acceptance/"
+    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks test/ test/acceptance/ && cat ./coverage/lcov.info | coveralls"
   }
 }

From 33dc6629ff13a5cc6db04460cd1c6cf982a3ba6d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 18 May 2014 01:30:44 -0400
Subject: [PATCH 09/13] update connect to 2.16.2

---
 History.md   | 4 +++-
 package.json | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 6226f105..e2fbe02f 100644
--- a/History.md
+++ b/History.md
@@ -9,15 +9,17 @@
    - `app.set('trust proxy', '10.0.0.1, 10.0.0.2')` trust list
    - `app.set('trust proxy', false)` turn off
    - `app.set('trust proxy', true)` trust everything
- * update connect to 2.16.1
+ * update connect to 2.16.2
    - deprecate `res.headerSent` -- use `res.headersSent`
    - deprecate `res.on("header")` -- use on-headers module instead
+   - fix edge-case in `res.appendHeader` that would append in wrong order
    - json: use body-parser
    - urlencoded: use body-parser
    - dep: bytes@1.0.0
    - dep: cookie-parser@1.1.0
    - dep: csurf@1.2.0
    - dep: express-session@1.1.0
+   - dep: method-override@1.0.1
 
 3.6.0 / 2014-05-09
 ==================
diff --git a/package.json b/package.json
index bf099970..575a10fa 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,7 @@
   "repository": "git://github.com/visionmedia/express",
   "license": "MIT",
   "dependencies": {
-    "connect": "2.16.1",
+    "connect": "2.16.2",
     "commander": "1.3.2",
     "methods": "1.0.0",
     "mkdirp": "0.5.0",

From a96924a55501afde39d0021f0fc70638527b643b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 18 May 2014 01:35:12 -0400
Subject: [PATCH 10/13] build: remove lib-cov fork

---
 index.js | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/index.js b/index.js
index bfe99345..3da33783 100644
--- a/index.js
+++ b/index.js
@@ -1,4 +1,2 @@
 
-module.exports = process.env.EXPRESS_COV
-  ? require('./lib-cov/express')
-  : require('./lib/express');
\ No newline at end of file
+module.exports = require('./lib/express');

From 1f938c560a398d7b65de35e6f3077fbb4f36272e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 18 May 2014 01:54:05 -0400
Subject: [PATCH 11/13] tests: improve examples/auth tests

---
 test/acceptance/auth.js | 98 +++++++++++++++++++++++++++++++++--------
 1 file changed, 79 insertions(+), 19 deletions(-)

diff --git a/test/acceptance/auth.js b/test/acceptance/auth.js
index 7f884df0..2645f7b6 100644
--- a/test/acceptance/auth.js
+++ b/test/acceptance/auth.js
@@ -1,13 +1,5 @@
 var app = require('../../examples/auth/app')
-  , request = require('supertest');
-
-function redirects(to, fn){
-  return function(err, res){
-    res.statusCode.should.equal(302)
-    res.headers.should.have.property('location').match(to);
-    fn()
-  }
-}
+var request = require('supertest')
 
 function getCookie(res) {
   return res.headers['set-cookie'][0].split(';')[0];
@@ -18,25 +10,93 @@ describe('auth', function(){
     it('should redirect to /login', function(done){
       request(app)
       .get('/')
-      .end(redirects(/\/login$/, done))
+      .expect('Location', '/login')
+      .expect(302, done)
     })
   })
 
-  describe('GET /restricted (w/o cookie)',function(){
-    it('should redirect to /login', function(done){
+  describe('GET /login',function(){
+    it('should render login form', function(done){
       request(app)
-      .get('/restricted')
-      .end(redirects(/\/login$/,done))
+      .get('/login')
+      .expect(200, /<form/, done)
     })
-  })
 
-  describe('POST /login', function(){
-    it('should fail without proper credentials', function(done){
+    it('should display login error', function(done){
       request(app)
       .post('/login')
       .type('urlencoded')
       .send('username=not-tj&password=foobar')
-      .end(redirects(/\/login$/, done))
+      .expect('Location', '/login')
+      .expect(302, function(err, res){
+        if (err) return done(err)
+        request(app)
+        .get('/login')
+        .set('Cookie', getCookie(res))
+        .expect(200, /Authentication failed/, done)
+      })
     })
   })
-})
\ No newline at end of file
+
+  describe('GET /logout',function(){
+    it('should redirect to /', function(done){
+      request(app)
+      .get('/logout')
+      .expect('Location', '/')
+      .expect(302, done)
+    })
+  })
+
+  describe('GET /restricted',function(){
+    it('should redirect to /login without cookie', function(done){
+      request(app)
+      .get('/restricted')
+      .expect('Location', '/login')
+      .expect(302, done)
+    })
+
+    it('should succeed with proper cookie', function(done){
+      request(app)
+      .post('/login')
+      .type('urlencoded')
+      .send('username=tj&password=foobar')
+      .expect('Location', '/')
+      .expect(302, function(err, res){
+        if (err) return done(err)
+        request(app)
+        .get('/restricted')
+        .set('Cookie', getCookie(res))
+        .expect(200, done)
+      })
+    })
+  })
+
+  describe('POST /login', function(){
+    it('should fail without proper username', function(done){
+      request(app)
+      .post('/login')
+      .type('urlencoded')
+      .send('username=not-tj&password=foobar')
+      .expect('Location', '/login')
+      .expect(302, done)
+    })
+
+    it('should fail without proper password', function(done){
+      request(app)
+      .post('/login')
+      .type('urlencoded')
+      .send('username=tj&password=baz')
+      .expect('Location', '/login')
+      .expect(302, done)
+    })
+
+    it('should succeed with proper credentials', function(done){
+      request(app)
+      .post('/login')
+      .type('urlencoded')
+      .send('username=tj&password=foobar')
+      .expect('Location', '/')
+      .expect(302, done)
+    })
+  })
+})

From 787d6301570e7c54cc433a11778c3363bf26976e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 18 May 2014 10:38:42 -0400
Subject: [PATCH 12/13] update should to 3.3.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 575a10fa..39f74e6d 100644
--- a/package.json
+++ b/package.json
@@ -67,10 +67,10 @@
     "ejs": "~0.8.4",
     "istanbul": "0.2.10",
     "mocha": "~1.18.2",
+    "should": "~3.3.1",
     "jade": "~0.30.0",
     "hjs": "~0.0.6",
     "stylus": "~0.40.0",
-    "should": "~2.1.1",
     "connect-redis": "~1.4.5",
     "marked": "0.2.10",
     "supertest": "~0.12.1"

From b91cd66fc59790cb838b9b3dde32de8c99ded2c2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 18 May 2014 10:40:13 -0400
Subject: [PATCH 13/13] 3.7.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index e2fbe02f..29a307a0 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.7.0 / 2014-05-18
+==================
 
  * proper proxy trust with `app.set('trust proxy', trust)`
    - `app.set('trust proxy', 1)` trust first hop
diff --git a/package.json b/package.json
index 39f74e6d..9d0f9940 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.6.0",
+  "version": "3.7.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {