diff --git a/src/apps.js b/src/apps.js
index 59adcc71a..0b91fd5f4 100644
--- a/src/apps.js
+++ b/src/apps.js
@@ -275,6 +275,10 @@ function validateSecondaryDomains(secondaryDomains, manifest) {
 
     const httpPorts = manifest.httpPorts || {};
 
+    for (const envName in httpPorts) { // each httpPort is required
+        if (!(envName in secondaryDomains)) return new BoxError(BoxError.BAD_FIELD, `secondaryDomain ${envName} is required`);
+    }
+
     for (const envName in secondaryDomains) {
         if (!(envName in httpPorts)) return new BoxError(BoxError.BAD_FIELD, `Invalid secondaryDomain in ${envName}`);
     }
@@ -283,11 +287,11 @@ function validateSecondaryDomains(secondaryDomains, manifest) {
 }
 
 function translateSecondaryDomains(secondaryDomains) {
-    assert.strictEqual(typeof secondaryDomains, 'object');
+    assert(secondaryDomains && typeof secondaryDomains === 'object');
 
     const result = [];
     for (const envName in secondaryDomains) {
-        result.push([ { domain: secondaryDomains[envName].domain, subdomain: secondaryDomains[envName].subdomain, environmentVariable: envName }]);
+        result.push({ domain: secondaryDomains[envName].domain, subdomain: secondaryDomains[envName].subdomain, environmentVariable: envName });
     }
     return result;
 }
@@ -1270,13 +1274,9 @@ async function install(data, auditSource) {
     error = validateTags(tags);
     if (error) throw error;
 
-    let secondaryDomains = [];
-    if ('secondaryDomains' in data) {
-        error = validateSecondaryDomains(data.secondaryDomains, manifest);
-        if (error) throw error;
-
-        secondaryDomains = translateSecondaryDomains(data.secondaryDomains);
-    }
+    error = validateSecondaryDomains(data.secondaryDomains || {}, manifest);
+    if (error) throw error;
+    const secondaryDomains = translateSecondaryDomains(data.secondaryDomains || {});
 
     let sso = 'sso' in data ? data.sso : null;
     if ('sso' in data && !('optionalSso' in manifest)) throw new BoxError(BoxError.BAD_FIELD, 'sso can only be specified for apps with optionalSso');
@@ -1720,12 +1720,9 @@ async function setLocation(app, data, auditSource) {
         values.mailboxDomain = values.domain;
     }
 
-    if ('secondaryDomains' in data) {
-        error = validateSecondaryDomains(data.secondaryDomains, app.manifest);
-        if (error) throw error;
-
-        values.secondaryDomains = translateSecondaryDomains(data.secondaryDomains);
-    }
+    error = validateSecondaryDomains(data.secondaryDomains || {}, app.manifest);
+    if (error) throw error;
+    values.secondaryDomains = translateSecondaryDomains(data.secondaryDomains || {});
 
     if ('redirectDomains' in data) {
         values.redirectDomains = data.redirectDomains;
diff --git a/src/reverseproxy.js b/src/reverseproxy.js
index 8b49561c1..132f34f6a 100644
--- a/src/reverseproxy.js
+++ b/src/reverseproxy.js
@@ -500,7 +500,7 @@ async function writeAppNginxConfig(app, fqdn, type, bundle) {
         robotsTxtQuoted: null,
         cspQuoted: null,
         hideHeaders: [],
-        proxyAuth: null,
+        proxyAuth: { enabled: false },
         ocsp: await isOcspEnabled(bundle.certFilePath)
     };