From 939116cce96ee7d0d9bfce1e563dd3d7b1b75638 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= Date: Sat, 12 Apr 2025 13:24:41 +0200 Subject: [PATCH] add `backend.trustProxy` MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Fredrik Adelöw --- .changeset/plain-groups-sleep.md | 17 +++++++++++++++++ packages/backend-defaults/config.d.ts | 13 +++++++++++++ .../rootHttpRouterServiceFactory.ts | 5 +++++ 3 files changed, 35 insertions(+) create mode 100644 .changeset/plain-groups-sleep.md diff --git a/.changeset/plain-groups-sleep.md b/.changeset/plain-groups-sleep.md new file mode 100644 index 0000000000..c14d85e4ff --- /dev/null +++ b/.changeset/plain-groups-sleep.md @@ -0,0 +1,17 @@ +--- +'@backstage/backend-defaults': patch +--- + +Added an optional `backend.trustProxy` app config value, which sets the +corresponding [Express.js `trust proxy`](https://expressjs.com/en/guide/behind-proxies.html) setting. This lets +you easily configure proxy trust without making a custom `configure` callback +for the `rootHttpRouter` service. + +If you already are using a custom `configure` callback, and if that also _does not_ call `applyDefaults()`, you may want to add the following to it: + +```ts +const trustProxy = config.getOptional('backend.trustProxy'); +if (trustProxy !== undefined) { + app.set('trust proxy', trustProxy); +} +``` diff --git a/packages/backend-defaults/config.d.ts b/packages/backend-defaults/config.d.ts index efd14afc2e..622081f08a 100644 --- a/packages/backend-defaults/config.d.ts +++ b/packages/backend-defaults/config.d.ts @@ -51,6 +51,19 @@ export interface Config { serverShutdownDelay?: string | HumanDuration; }; + /** + * Corresponds to the Express `trust proxy` setting. + * + * @see https://expressjs.com/en/guide/behind-proxies.html + * @remarks + * + * This setting is used to determine whether the backend should trust the + * `X-Forwarded-*` headers that are set by proxies. This is important for + * determining the original client IP address and protocol (HTTP/HTTPS) when + * the backend is behind a reverse proxy or load balancer. + */ + trustProxy?: boolean | number | string | string[]; + /** Address that the backend should listen to. */ listen?: | string diff --git a/packages/backend-defaults/src/entrypoints/rootHttpRouter/rootHttpRouterServiceFactory.ts b/packages/backend-defaults/src/entrypoints/rootHttpRouter/rootHttpRouterServiceFactory.ts index e5c64124fd..da7fcfe3f9 100644 --- a/packages/backend-defaults/src/entrypoints/rootHttpRouter/rootHttpRouterServiceFactory.ts +++ b/packages/backend-defaults/src/entrypoints/rootHttpRouter/rootHttpRouterServiceFactory.ts @@ -87,6 +87,8 @@ const rootHttpRouterServiceFactoryWithOptions = ( const logger = rootLogger.child({ service: 'rootHttpRouter' }); const app = express(); + const trustProxy = config.getOptional('backend.trustProxy'); + const router = DefaultRootHttpRouter.create({ indexPath }); const middleware = MiddlewareFactory.create({ config, logger }); const routes = router.handler(); @@ -112,6 +114,9 @@ const rootHttpRouterServiceFactoryWithOptions = ( if (process.env.NODE_ENV === 'development') { app.set('json spaces', 2); } + if (trustProxy !== undefined) { + app.set('trust proxy', trustProxy); + } app.use(middleware.helmet()); app.use(middleware.cors()); app.use(middleware.compression());