From d43d1a3f3481eb56c0abcf08decde678af974207 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?K=C3=BChn?= Date: Thu, 10 Sep 2026 17:07:14 +0200 Subject: [PATCH] H3-Fix: TRUST_PROXY konfigurierbar (H3: Rate-Limit-Bypass hinter Proxy geloest) --- backend/server.js | 14 ++++++++++++-- docker-compose.stack.yml | 2 ++ docker-compose.yml | 2 ++ 3 files changed, 16 insertions(+), 2 deletions(-) diff --git a/backend/server.js b/backend/server.js index 4919943..9eab90b 100644 --- a/backend/server.js +++ b/backend/server.js @@ -48,8 +48,18 @@ const { startLDAPSync, isLDAPConfigured } = require('./ldapSync'); const app = express(); const PORT = process.env.PORT || 5000; -// Trust proxy for correct IP in rate limiting (Docker/Reverse Proxy) -app.set('trust proxy', 1); +// H3-Fix: Trust proxy konfigurierbar — hinter TLS-terminierendem Proxy (HAProxy) +// MUSS trust proxy aktiv sein, damit Express die echte Client-IP aus +// X-Forwarded-For liest (Rate-Limiting, Audit-Log). Bei direktem Port-Zugriff +// (ohne Proxy) muss es deaktiviert sein, sonst ist X-Forwarded-For spoofbar +// und das Rate-Limiting umgehbar. +// TRUST_PROXY=true → 1 Hop vertrauen (HAProxy/Nginx davor) ← Produktion +// TRUST_PROXY=false → keine Proxy-Header vertrauen ← direkter Zugriff +// unset → true in Produktion (Docker-Stack läuft hinter HAProxy) +const TRUST_PROXY = process.env.TRUST_PROXY !== undefined + ? process.env.TRUST_PROXY === 'true' + : process.env.NODE_ENV === 'production'; +app.set('trust proxy', TRUST_PROXY ? 1 : false); // ============ Security Middleware ============ // P14: Validate CORS_ORIGIN - filter empty/invalid entries before using in CSP diff --git a/docker-compose.stack.yml b/docker-compose.stack.yml index 607c624..9f0ebbd 100644 --- a/docker-compose.stack.yml +++ b/docker-compose.stack.yml @@ -37,6 +37,8 @@ services: - UPLOAD_MAX_MB=${UPLOAD_MAX_MB:-10} - CORS_ORIGIN=${CORS_ORIGIN:-http://localhost:3900} - NODE_ENV=${NODE_ENV:-production} + # H3: Proxy-Header vertrauen (true hinter HAProxy/Nginx, false bei direktem Zugriff) + - TRUST_PROXY=${TRUST_PROXY:-true} - DATABASE_URL=postgresql://${POSTGRES_USER:-workflow}:${POSTGRES_PASSWORD:-workflow}@db:5432/${POSTGRES_DB:-workflow} - SESSION_MAX_PER_USER=${SESSION_MAX_PER_USER:-5} - SESSION_TTL_HOURS=${SESSION_TTL_HOURS:-168} diff --git a/docker-compose.yml b/docker-compose.yml index 90a519d..9fc8a4b 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -24,6 +24,8 @@ services: - SESSION_SECRET=${SESSION_SECRET:-} - CORS_ORIGIN=${CORS_ORIGIN:-http://localhost:5000} - NODE_ENV=${NODE_ENV:-production} + # H3: Proxy-Header vertrauen (true hinter HAProxy/Nginx, false bei direktem Zugriff) + - TRUST_PROXY=${TRUST_PROXY:-true} # Punkt 4: PostgreSQL (auto-started) - DATABASE_URL=postgresql://${POSTGRES_USER:-workflow}:${POSTGRES_PASSWORD:-workflow}@db:5432/${POSTGRES_DB:-workflow} # Punkt 9: Session-Limitierung