Forwarding Client's IP Address when Using an HTTP Reverse Proxy.

Heya,

Modify your proxy.js to explicitly pass the X-Forwarded-For header:

const httpProxy = require('http-proxy');
const proxy = httpProxy.createProxyServer({
    xfwd: true
});

Using xfwd: true ensures that X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Proto are included in the request.

You already have app.set('trust proxy', true); in your Express app, but it may not be strict enough. Try setting it explicitly:

app.set('trust proxy', 'loopback');

If your proxy and backend are on the same machine, this ensures only loopback connections are trusted.

If your proxy is on a different server, set a specific IP address:

app.set('trust proxy', '192.168.1.100');

For multiple proxies, use an array:

app.set('trust proxy', ['192.168.1.100', '192.168.1.101']);

Also, you can change how you extract req.clientIp:

app.use((req, res, next) => {
    const forwarded = req.headers['x-forwarded-for'];
    req.clientIp = forwarded ? forwarded.split(',')[0].trim() : req.socket.remoteAddress;
    console.log(`Client IP: ${req.clientIp}`);
    next();
});

This ensures:

• If X-Forwarded-For contains multiple IPs, it extracts the first IP (which is the real client IP).
• If no proxy header exists, it falls back to req.socket.remoteAddress.