Skip to content

[node-fetch-server] Optionally take into account Forwarded/X-Forwarded-Proto request headers for request URL #10874

@r52j

Description

@r52j

Currently, the protocol of the URL in the Request object is set solely based on whether the incoming connection uses TLS:

let protocol =
options?.protocol ?? ('encrypted' in req.socket && req.socket.encrypted ? 'https:' : 'http:')

However, in setups with a reverse proxy, it is necessary to take into account the protocol information from the Forwarded/X-Forwarded-For headers to get the protocol used by the original client.

This should most definitely be opt-in using a createRequestListener option as it allows for protocol spoofing in setups without a reverse proxy. Cf. for example Express's trust proxy option: https://expressjs.com/en/guide/behind-proxies.html

The existing createRequestListener option to set a fixed protocol is not sufficient for all setups, as clients might use different protocols and that information might be relevant for the application.

Last but not least: Thank you all for your great work on React Router and Remix!

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions