Skip to content

Commit 171359d

Browse files
melvincarvalhomelvincarvalho
committed
server: HOST env — bind loopback behind a reverse proxy so TRUST_PROXY=1 stays truthful (no direct-port XFF spoofing)
1 parent ea59087 commit 171359d

1 file changed

Lines changed: 3 additions & 1 deletion

File tree

‎server.js‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -469,7 +469,9 @@ if (entry) {
469469
dataDir: process.env.DATA || './data',
470470
publicUrl: process.env.PUBLIC_URL || null,
471471
});
472-
const { port, origin } = await node.listen(Number(process.env.PORT || 3480));
472+
// HOST=127.0.0.1 for reverse-proxy deployments: the proxy is the only
473+
// client, TRUST_PROXY=1 stays truthful, and the direct port disappears.
474+
const { port, origin } = await node.listen(Number(process.env.PORT || 3480), process.env.HOST || '0.0.0.0');
473475
console.log(`solidpay node listening on port ${port}`);
474476
console.log(` app: ${origin}/`);
475477
console.log(` api: ${origin}/api/graph`);

0 commit comments

Comments
 (0)