Fix: Enable Express trust proxy for client IP forwarding #348
Conversation
|
Preview is available here: |
Allows rate limiting to work per actual client IP instead of ingress pod IP when running behind NGINX Ingress.
|
Preview is available here: |
marcelosalloum
changed the title
There was a problem hiding this comment.
Pull request overview
This PR enables Express's trust proxy setting to allow the application to correctly identify client IPs when running behind NGINX Ingress. This is essential for the rate limiting functionality to work correctly per actual client IP rather than seeing all requests as coming from the ingress pod IP.
Changes:
- Added
app.set("trust proxy", true)configuration to enable proxy IP forwarding in Express
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
backend/routes.ts
Outdated
|
|
||
| // Trust proxy to get real client IPs behind NGINX Ingress | ||
| // This allows rate limiting to work per actual client IP instead of per ingress pod IP | ||
| app.set("trust proxy", true); |
There was a problem hiding this comment.
Setting trust proxy to true trusts all proxies, which can be a security risk if the application is accessible without going through the expected proxy. Consider using a more specific value like 1 (trust only the first hop) or "loopback, linklocal, uniquelocal" (trust only private IP ranges), or make it configurable via an environment variable. This prevents potential IP spoofing attacks if the application is accidentally exposed directly to the internet.
| app.set("trust proxy", true); | |
| const trustProxySetting = process.env.TRUST_PROXY ?? "loopback, linklocal, uniquelocal"; | |
| app.set("trust proxy", trustProxySetting); |
|
Preview is available here: |
|
Preview is available here: |
|
Preview is available here: |
|
Preview is available here: |
What
Allows rate limiting to work per actual client IP instead of ingress pod IP when running behind a reverse proxy such as NGINX Ingress, or Cloudflare.
"trust proxy" relies on the
TRUST_PROXYenv and defaults to"loopback,linklocal,uniquelocal"Why
All IPs were being considered the same IP for the global rate-limiter, which was triggering 429s somewhat often.