root
8fc88ffc14
Build & Push / Pipeline Tests (push) Failing after 59s
Build & Push / Build & Push Docker Image (push) Has been skipped
Test / Type Check (all packages) (push) Failing after 51s
Test / API Unit Tests (push) Has been skipped
Test / Homepage Unit Tests (push) Has been skipped
Test / Carplace Unit Tests (push) Has been skipped
Test / Admin Unit Tests (push) Has been skipped
Test / Dashboard Unit Tests (push) Has been skipped
Test / API Integration Tests (push) Has been skipped
922 B
922 B
Proxy trust & forwarded headers (S9)
Default: TRUSTED_FORWARD_HEADERS is unset/false. The API deletes client-supplied forwarding headers (x-forwarded-for, x-real-ip, etc.) so rate limits and logs cannot be spoofed.
When to set TRUSTED_FORWARD_HEADERS=true
Only when:
- Traefik / nginx / cloud LB is the only ingress to the API.
- That edge overwrites (not appends blindly from the client) trusted client IP / proto headers.
- The API
trust proxyhop count matches the real proxy chain.
If any of those are false, leave the flag off.
Operator checklist
- Edge strips spoofed
X-Forwarded-*from the public internet - Documented hop count for Express
trust proxy - Rate-limit keys still meaningful after deploy
- Change reviewed in incident/runbook (misconfiguration → IP allowlist / rate-limit bypass)
Related: apps/api/src/middleware/forwardedHeaders.ts