# Proxy trust & forwarded headers (S9)

**Default:** `TRUSTED_FORWARD_HEADERS` is unset/false. The API **deletes** client-supplied forwarding headers (`x-forwarded-for`, `x-real-ip`, etc.) so rate limits and logs cannot be spoofed.

## When to set `TRUSTED_FORWARD_HEADERS=true`

Only when:

1. Traefik / nginx / cloud LB is the **only** ingress to the API.
2. That edge **overwrites** (not appends blindly from the client) trusted client IP / proto headers.
3. The API `trust proxy` hop count matches the real proxy chain.

If any of those are false, leave the flag off.

## Operator checklist

- [ ] Edge strips spoofed `X-Forwarded-*` from the public internet
- [ ] Documented hop count for Express `trust proxy`
- [ ] Rate-limit keys still meaningful after deploy
- [ ] Change reviewed in incident/runbook (misconfiguration → IP allowlist / rate-limit bypass)

Related: `apps/api/src/middleware/forwardedHeaders.ts`