feat: specify trust proxies

server/package.json

@@ -34,6 +34,7 @@
     "passport-local": "^1.0.0",
     "socket.io": "^4.7.1",
     "swagger-ui-express": "^5.0.0",
+    "validator": "^13.11.0",
     "yaml": "^2.3.1"
   },
   "devDependencies": {

server/src/api/routes/index.js

@@ -5,16 +5,19 @@ import quests from './quests.js'
 import commands from './commands.js'
 import authRouter from './auth.js'
 import authRequired from '../../middleware/authRequired.js'
+import config from '../../config.js'
 
 const router = Router()
 
-router.get('/', (req, res) => {
-  res.send('Hello API!')
-})
+if (!config.isProduction) {
+  router.get('/', (req, res) => {
+    res.send('Hello API!')
+  })
 
-router.get('/ip', (req, res) => {
-  res.json({ ip: req.ip })
-})
+  router.get('/ip', (req, res) => {
+    res.json({ ip: req.ip, forwarded: req.headers['x-forwarded-for'] })
+  })
+}
 
 router.use('/auth', authRouter)
 router.use('/quests', quests)

server/src/config.js

@@ -1,5 +1,16 @@
+import validator from 'validator'
 import { get } from './utils/env.js'
 
+function getTrustProxies(key) {
+  if (!process.env[key]) {
+    return []
+  }
+  return process.env[key]
+    .split(',')
+    .map((p) => validator.trim(p))
+    .filter((p) => validator.isIPRange(p) || validator.isIP(p))
+}
+
 const config = {
   host: get('HOST', 'localhost'),
   port: get('PORT', 3000),
@@ -18,6 +29,7 @@ const config = {
     clientID: get('GITHUB_CLIENT_ID', ''),
     clientSecret: get('GITHUB_CLIENT_SECRET', ''),
   },
+  trustedProxies: getTrustProxies('TRUSTED_PROXIES'),
 }
 
 config.baseUrl = get('BASE_URL', `http://${config.host}:${config.port}`)

server/src/index.js

@@ -42,7 +42,13 @@ async function main() {
   const app = express()
   const server = http.createServer(app)
   socketServer(server)
-  app.set('trust proxy', true)
+  app.set('trust proxy', [
+    'loopback',
+    'linklocal',
+    'uniquelocal',
+    ...config.trustedProxies,
+  ])
+  console.log('Trusted proxies:', config.trustedProxies)
   app.use(globalRateLimit)
   app.use(sessionMiddleware)
   app.use(passport.session())