NodeJS, Express, why should I use app.enable('trust proxy');
If your not running behind a proxy, it's not required. Eg, if your running multiple websites on a server, chances are your using a Proxy.
X-Forwarded-For header attributes get added when doing this so that your proxy can see what the original url was, proxying in the end will be going to localhost you see. The reason why it's needed is that X-Forwared-For can be faked, there is nothing stopping the client adding these too, not just a proxy. So trust-proxy should only be enabled on the receiving end, that would be behind your firewall. Because you have control, you can trust this.
So in a nutshell, if your website is running behind a proxy, you can enable it. If you website is running direct on port 80, you don't want to trust it. As the sender could pretend to be coming from localhost etc.
Comments
-
Aviel Fedida almost 2 years
I was needed to redirect http to https and found this code:
app.enable('trust proxy'); app.use((req, res, next) => { if (req.secure) { next(); } else { res.redirect('https://' + req.headers.host + req.url); } });
I'm using heroku to host my project, I noticed that heroku as default issued
*.herokuapp.com
cert, so I can use http and https as well.When looked at
req.secure
withinapp.use
callback, withoutapp.enable('trust proxy')
,req.secure
is alwaysfalse
, when I addapp.enable('trust proxy')
it's false for about 2 times and after thehttps
redirection it's switches totrue
.app.enable('trust proxy')
, the docs:Indicates the app is behind a front-facing proxy, and to use the X-Forwarded-* headers to determine the connection and the IP address of the client.
My question:
Why would my server be behind a proxy?(is it relates to the issued
*.herokuapp.com
cert?), if someone could explain how all fits together, I mean, why my server is behind a proxy? and why withoutapp.enable
express won't identify(or accept) secure connection?