-
Notifications
You must be signed in to change notification settings - Fork 189
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
set trust for first proxy when env is prod #3793
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
From the docs:
Number: use the address that is at most n number of hops away from the Express application. req.socket.remoteAddress is the first hop, and the rest are looked for in the X-Forwarded-For header from right to left. A value of 0 means that the first untrusted address would be req.socket.remoteAddress, i.e. there is no reverse proxy.When using this setting, it is important to ensure there are not multiple, different-length paths to the Express application such that the client can be less than the configured number of hops away, otherwise it may be possible for the client to provide any value.
We are behind 2 proxies:
- nginx
- traefik
I wonder if this should be 2? I'm not sure.
I suppose you're right, it should probably be 2 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think this is good. @manekenpix, do you have any concerns?
@humphd LGTM 👍 |
Can I squash and merge? |
@sfrunza13 I think this is good to go. |
@sfrunza13 yeah, go for it |
Issue This PR Addresses
Fixes #3792
Type of Change
Description
I am trying to find a way to make the new cookie settings work, perhaps this might be a step in the right direction.
Steps to test the PR
Checklist