Build a predicate answering whether an observed peer address is one of the
configured trusted proxies.
Feed it the peer address, never req.ip.req.ip is derived from
X-Forwarded-For whenever Express trust proxy is on, so authenticating a
forwarding hop with it would be authenticating one header with another and
would make the allowlist decorative. The only thing on an HTTP request an
attacker cannot choose is the address of the peer that opened the TCP
connection — req.socket.remoteAddress.
An IPv4 entry (literal or range) also matches the IPv4-mapped IPv6 form
(::ffff:10.0.0.7) Node reports on a dual-stack listener, so operators do
not have to know which family the listener bound.
An empty list produces a predicate that trusts nothing. That is the correct
fail-closed behaviour: callers that require a non-empty allowlist enforce it
at boot with an operator-facing message, and this layer must not be the thing
that decides an unconfigured deployment is safe.
Throws at construction on an unusable entry — see
checkTrustedProxyEntry. A hostname or a typo would otherwise never
match and turn a deliberate allowlist into a silent outage.
Build a predicate answering whether an observed peer address is one of the configured trusted proxies.
Feed it the peer address, never
req.ip.req.ipis derived fromX-Forwarded-Forwhenever Expresstrust proxyis on, so authenticating a forwarding hop with it would be authenticating one header with another and would make the allowlist decorative. The only thing on an HTTP request an attacker cannot choose is the address of the peer that opened the TCP connection —req.socket.remoteAddress.An IPv4 entry (literal or range) also matches the IPv4-mapped IPv6 form (
::ffff:10.0.0.7) Node reports on a dual-stack listener, so operators do not have to know which family the listener bound.An empty list produces a predicate that trusts nothing. That is the correct fail-closed behaviour: callers that require a non-empty allowlist enforce it at boot with an operator-facing message, and this layer must not be the thing that decides an unconfigured deployment is safe.
Throws at construction on an unusable entry — see checkTrustedProxyEntry. A hostname or a typo would otherwise never match and turn a deliberate allowlist into a silent outage.