lxe/workflow-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

H3-Fix: TRUST_PROXY konfigurierbar (H3: Rate-Limit-Bypass hinter Proxy geloest)

Browse Source
This commit is contained in:
Kühn
2026-09-10 17:07:14 +02:00
parent ad6983a49d
commit d43d1a3f34
3 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
backend/server.js
View File

@@ -48,8 +48,18 @@ const { startLDAPSync, isLDAPConfigured } = require('./ldapSync');
const app = express();
const PORT = process.env.PORT || 5000;
// Trust proxy for correct IP in rate limiting (Docker/Reverse Proxy)
app.set('trust proxy', 1);
// H3-Fix: Trust proxy konfigurierbar — hinter TLS-terminierendem Proxy (HAProxy)
// MUSS trust proxy aktiv sein, damit Express die echte Client-IP aus
// X-Forwarded-For liest (Rate-Limiting, Audit-Log). Bei direktem Port-Zugriff
// (ohne Proxy) muss es deaktiviert sein, sonst ist X-Forwarded-For spoofbar
// und das Rate-Limiting umgehbar.
// TRUST_PROXY=true → 1 Hop vertrauen (HAProxy/Nginx davor) ← Produktion
// TRUST_PROXY=false → keine Proxy-Header vertrauen ← direkter Zugriff
// unset → true in Produktion (Docker-Stack läuft hinter HAProxy)
const TRUST_PROXY = process.env.TRUST_PROXY !== undefined
? process.env.TRUST_PROXY === 'true'
: process.env.NODE_ENV === 'production';
app.set('trust proxy', TRUST_PROXY ? 1 : false);
// ============ Security Middleware ============
// P14: Validate CORS_ORIGIN - filter empty/invalid entries before using in CSP