node.js - "trust proxy"在 express.js 中实际上做了什么，我需要使用它吗？

Question

我正在编写一个位于 nginx 服务器后面的快速应用程序。我正在阅读 express 的文档，其中提到了“信任代理”设置。它只是说

trust proxy Enables reverse proxy support, disabled by default

我在这里阅读了一篇小文章，它解释了使用 nginx 在 Node 中的安全 session 。

http://blog.nikmartin.com/2013/07/secure-sessions-in-nodejs-with-nginx.html

所以我很好奇。仅在使用 HTTPS 时才将“信任代理”设置为 true 吗？目前我的应用程序只是客户端和 nginx 之间的 HTTP。如果我现在将其设置为 true，是否需要注意任何副作用/影响？现在将其设置为 true 有什么意义吗？

Answer 1

这在 express behind the proxies guide 中有详细解释。

By enabling the "trust proxy" setting via app.enable('trust proxy'), Express will have knowledge that it's sitting behind a proxy and that the X-Forwarded-* header fields may be trusted, which otherwise may be easily spoofed.

Enabling this setting has several subtle effects. The first of which is that X-Forwarded-Proto may be set by the reverse proxy to tell the app that it is https or simply http. This value is reflected by req.protocol.

The second change this makes is the req.ip and req.ips values will be populated with X-Forwarded-For's list of addresses.