Express and Node.js Training from StrongLoop

Express behind proxies

When running an Express app behind a proxy, set (using app.set()) the application variable trust proxy to one of the values listed in the following table.

While the app will not fail to run if the application variable trust proxy is not set, it will incorrectly register the proxy’s IP address as the client IP address unless trust proxy is configured.

TypeValue
Boolean

If true, the client’s IP address is understood as the left-most entry in the X-Forwarded-* header.

If false, the app is understood as directly facing the Internet and the client’s IP address is derived from req.connection.remoteAddress. This is the default setting.

IP addresses

An IP address, subnet, or an array of IP addresses, and subnets to trust. The following is the list of pre-configured subnet names.

  • loopback - 127.0.0.1/8, ::1/128
  • linklocal - 169.254.0.0/16, fe80::/10
  • uniquelocal - 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, fc00::/7

Set IP addresses in any of the following ways:

app.set('trust proxy', 'loopback') // specify a single subnet
app.set('trust proxy', 'loopback, 123.123.123.123') // specify a subnet and an address
app.set('trust proxy', 'loopback, linklocal, uniquelocal') // specify multiple subnets as CSV
app.set('trust proxy', ['loopback', 'linklocal', 'uniquelocal']) // specify multiple subnets as an array

When specified, the IP addresses or the subnets are excluded from the address determination process, and the untrusted IP address nearest to the application server is determined as the client’s IP address.

Number

Trust the nth hop from the front-facing proxy server as the client.

Function

Custom trust implementation. Use this only if you know what you are doing.

app.set('trust proxy', function (ip) {
  if (ip === '127.0.0.1' || ip === '123.123.123.123') return true; // trusted IPs
  else return false;
})

Setting a non-false trust proxy value results in two important changes:

The trust proxy setting is implemented using the proxy-addr package. For more information, see its documentation.