fix: enable "real" client IP visibility even behind proxies

[999LV]

Complements b1dc1a4

[coveralls]

Pull Request Test Coverage Report for Build 4174501850

• 0 of 3 (0.0%) changed or added relevant lines in 1 file are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage decreased (-0.004%) to 23.832%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
app.ts	0	3	0.0%

Totals
Change from base Build 4174314480:	-0.004%
Covered Lines:	3818
Relevant Lines:	16921

---

💛 - Coveralls

[robertsLando]

I think it would be better to enable this based on an env var. @chrisns agree?

[chrisns]

I don't think we actually care in zwjs-ui what the ip is, apart from maybe logging?

agree, if we're going to define it must be an env var / config

setting trust to true is a really bad idea (though at the user's discretion if its configurable), it should really be more specific, and must only enabled in situations where a proxy is present, otherwise an actor with direct access could use it to masquerade as any ip they like.

I suspect most users don't have this behind a proxy (which is why auth exists within the app etc)

https://expressjs.com/en/guide/behind-proxies.html

[chrisns]

moved to draft, if its changed to be configurable, somewhere then it can be ready to review again.

[999LV]

Got your points, thank you. I'll resubmit based on an environment variable configuration (with default to 'false' so that it is really a user conscious decision)

[999LV]

On thinking further about this « origin ip » topic, I think it is better to withdraw that pull request indeed since it does not bring much but creates other risks. Apologies.

[coveralls]

Pull Request Test Coverage Report for Build 4174501850

Warning: This coverage report may be inaccurate.

This pull request's base commit is no longer the HEAD commit of its target branch. This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

• For more information on this, see Tracking coverage changes with pull request builds.
• To avoid this issue with future PRs, see these Recommended CI Configurations.
• For a quick fix, rebase this PR at GitHub. Your next report should be accurate.

Details

• 0 of 3 (0.0%) changed or added relevant lines in 1 file are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage decreased (-0.004%) to 23.832%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
app.ts	0	3	0.0%

Totals
Change from base Build 4174314480:	-0.004%
Covered Lines:	3818
Relevant Lines:	16921

---

💛 - Coveralls