fix production issues

2026-08-12 16:48:41 -04:00
parent 53de25120a
commit 8fc88ffc14
117 changed files with 4717 additions and 1443 deletions
@@ -0,0 +1,22 @@
+# Proxy trust & forwarded headers (S9)
+
+**Default:** `TRUSTED_FORWARD_HEADERS` is unset/false. The API **deletes** client-supplied forwarding headers (`x-forwarded-for`, `x-real-ip`, etc.) so rate limits and logs cannot be spoofed.
+
+## When to set `TRUSTED_FORWARD_HEADERS=true`
+
+Only when:
+
+1. Traefik / nginx / cloud LB is the **only** ingress to the API.
+2. That edge **overwrites** (not appends blindly from the client) trusted client IP / proto headers.
+3. The API `trust proxy` hop count matches the real proxy chain.
+
+If any of those are false, leave the flag off.
+
+## Operator checklist
+
+- [ ] Edge strips spoofed `X-Forwarded-*` from the public internet
+- [ ] Documented hop count for Express `trust proxy`
+- [ ] Rate-limit keys still meaningful after deploy
+- [ ] Change reviewed in incident/runbook (misconfiguration → IP allowlist / rate-limit bypass)
+
+Related: `apps/api/src/middleware/forwardedHeaders.ts`