fix: app.set('trust proxy', 1) — resolves ERR_ERL_UNEXPECTED_X_FORWARDED_FOR across all 9 dwf-* apps behind nginx

c069168c36ce37300eeff17407e623bf721159dd · 2026-06-01 14:17:07 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit c069168c36ce37300eeff17407e623bf721159dd
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon Jun 1 14:17:07 2026 -0700

    fix: app.set('trust proxy', 1) — resolves ERR_ERL_UNEXPECTED_X_FORWARDED_FOR across all 9 dwf-* apps behind nginx
---
 server.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/server.js b/server.js
index e1d6f47..8c8e13d 100644
--- a/server.js
+++ b/server.js
@@ -51,6 +51,11 @@ const HERO_IMGS = (Array.isArray(HERO_ALLOC[SITE]) && HERO_ALLOC[SITE].length >=
 const FEATURED = sortProducts(POOL, 'newest').slice(0, 20);
 
 const app = express();
+// Behind nginx (single reverse-proxy hop). Without this, express-rate-limit sees
+// the nginx-set X-Forwarded-For with trust-proxy OFF and throws
+// ERR_ERL_UNEXPECTED_X_FORWARDED_FOR on every request (all 9 dwf-* apps logged it).
+// trust proxy = 1 trusts exactly the first hop (nginx), so req.ip is the real client.
+app.set('trust proxy', 1);
 app.disable('x-powered-by');
 app.use(helmet({
   contentSecurityPolicy: {

← 10970b9 Standalone hero apply + size-vetted retry scripts (prod-side · back to Dw Domain Fleet · Add fleet-heroes.sh driver: repeatable fleet-wide hero refre addb71d →