Node

Express trust proxy and forwarded headers

trust proxy tells Express that requests arrive through a trusted reverse proxy and, for address chains, which proxy hops are trusted. Enabling it changes how Express calculates several request properties from forwarded headers:

X-Forwarded-For   -> req.ip and req.ips
X-Forwarded-Host  -> req.hostname
X-Forwarded-Proto -> req.protocol and req.secure

These properties are commonly used for logging, rate limiting, IP allowlists, local-only routes, redirects, absolute URLs, and asset origins. An attacker who can control a forwarded header accepted by the trusted proxy path can control the corresponding Express request property.

X-Forwarded-Port has no dedicated Express request property. It remains an ordinary request header available through req.headers. Application code that reads any forwarded header directly receives that header independently of trust proxy.

Identifying proxy trust

Search for the setting, the derived request properties, and direct forwarded-header access:

grep -RniE "trust proxy|req\.(ip|ips|hostname|protocol|secure)|x-forwarded-" .

The following setting trusts forwarded addresses:

app.set("trust proxy", true);

The Express default is false. With this default, req.ip uses req.socket.remoteAddress, req.hostname uses the Host header, and req.protocol uses the connection’s TLS state. Numeric, subnet, and custom-function values define which proxy hops are trusted and must be compared with the application’s actual proxy path.

_{Find by: node, nodejs, express, trust proxy, forwarded headers, x-forwarded-for, x-forwarded-host, x-forwarded-proto, x-forwarded-port, req.ip, req.ips, req.hostname, req.protocol, req.secure, client ip spoofing, host poisoning, absolute url}