Merge pull request #5798 from hrko/issue-5796-trust-proxy-config

feat: Made 'trust proxy' for express configurable

packages/app/src/server/crowi/express-init.js

@@ -57,6 +57,12 @@ module.exports = function(crowi, app) {
 
   app.use(compression());
 
+  const { configManager } = crowi;
+  const trustedProxies = configManager.getConfig('crowi', 'security:trustedProxies');
+  if (trustedProxies !== '') {
+    app.set('trust proxy', trustedProxies);
+  }
+
   app.use(helmet({
     contentSecurityPolicy: false,
     expectCt: false,

packages/app/src/server/service/config-loader.ts

@@ -364,6 +364,12 @@ const ENV_VAR_NAME_TO_CONFIG_INFO = {
     type:    ValueType.BOOLEAN,
     default: false,
   },
+  TRUSTED_PROXIES: {
+    ns:      'crowi',
+    key:     'security:trustedProxies',
+    type:    ValueType.STRING,
+    default: '',
+  },
   LOCAL_STRATEGY_ENABLED: {
     ns:      'crowi',
     key:     'security:passport-local:isEnabled',