From 43976194cb858f2a8fb82e7215a9847b4a8f9fb2 Mon Sep 17 00:00:00 2001 From: L HEREEC Kevin INNOV/PTFM Date: Mon, 13 Jul 2026 11:23:35 +0200 Subject: [PATCH] fix: trust proxy headers in production (behind SSL-terminating reverse proxy) --- config/app.ts | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/config/app.ts b/config/app.ts index c03915e..f18e3e7 100644 --- a/config/app.ts +++ b/config/app.ts @@ -13,6 +13,14 @@ export const appUrl = env.get('APP_URL') * The configuration settings used by the HTTP server */ export const http = defineConfig({ + /** + * Trust the X-Forwarded-* headers sent by a reverse proxy (e.g. Nginx). + * Required so that AdonisJS sees the real client IP and the correct + * protocol (https) when running behind an SSL-terminating proxy. + * Set to 1 to trust only the immediately-preceding proxy. + */ + trustProxy: app.inProduction, + /** * Generate a unique request id for each incoming request. * Useful to correlate logs and debug a request flow.