Intermediate LevelExpress JS
Why is setting app.set("trust proxy", true) blindly a severe security vulnerability?
❓ Interview Prompt: Explain IP spoofing vulnerabilities, X-Forwarded-For tampering, and configuring exact trusted subnet CIDRs in trust proxy.
Setting 'app.set("trust proxy", true)' blindly tells Express to trust the leftmost IP address in the 'X-Forwarded-For' header.
The Security Vulnerability:
Attackers can easily send a fake 'X-Forwarded-For: 1.2.3.4' header in their request. If Express trusts all proxies blindly, 'req.ip' will return the attacker's fake IP, completely bypassing IP-based rate limiters and firewall blocks!
•
Fix: Specify exact trusted proxy IP subnets: 'app.set("trust proxy", ["10.0.0.0/8", "172.16.0.0/12"])'.
Code Implementation Example
javascript
import express from 'express';
const app = express();
// ❌ VULNERABLE: Blindly trusts client-supplied X-Forwarded-For headers!
// app.set('trust proxy', true);
// ✅ SECURE: Trust ONLY specific internal reverse proxy subnet CIDRs!
app.set('trust proxy', ['loopback', '10.0.0.0/8']);💡Configuring secure trust proxy CIDR subnets to block IP spoofing.
🎯 Interview Key Takeaway
Never set trust proxy to true blindly. Specify exact trusted CIDR subnet arrays to prevent IP spoofing.
#trust proxy#IP Spoofing#Security#Intermediate
Back to all Express JS Questions→