root
8fc88ffc14
Build & Push / Pipeline Tests (push) Failing after 59s
Build & Push / Build & Push Docker Image (push) Has been skipped
Test / Type Check (all packages) (push) Failing after 51s
Test / API Unit Tests (push) Has been skipped
Test / Homepage Unit Tests (push) Has been skipped
Test / Carplace Unit Tests (push) Has been skipped
Test / Admin Unit Tests (push) Has been skipped
Test / Dashboard Unit Tests (push) Has been skipped
Test / API Integration Tests (push) Has been skipped
23 lines
922 B
Markdown
23 lines
922 B
Markdown
# Proxy trust & forwarded headers (S9)
|
|
|
|
**Default:** `TRUSTED_FORWARD_HEADERS` is unset/false. The API **deletes** client-supplied forwarding headers (`x-forwarded-for`, `x-real-ip`, etc.) so rate limits and logs cannot be spoofed.
|
|
|
|
## When to set `TRUSTED_FORWARD_HEADERS=true`
|
|
|
|
Only when:
|
|
|
|
1. Traefik / nginx / cloud LB is the **only** ingress to the API.
|
|
2. That edge **overwrites** (not appends blindly from the client) trusted client IP / proto headers.
|
|
3. The API `trust proxy` hop count matches the real proxy chain.
|
|
|
|
If any of those are false, leave the flag off.
|
|
|
|
## Operator checklist
|
|
|
|
- [ ] Edge strips spoofed `X-Forwarded-*` from the public internet
|
|
- [ ] Documented hop count for Express `trust proxy`
|
|
- [ ] Rate-limit keys still meaningful after deploy
|
|
- [ ] Change reviewed in incident/runbook (misconfiguration → IP allowlist / rate-limit bypass)
|
|
|
|
Related: `apps/api/src/middleware/forwardedHeaders.ts`
|