nginx proxymanager and zwave js ui

[akamming]

Hi,

to increase security i put zwave js ui behind a reverse proxy using nginx proxymanager. It works nicely, however wehener i access it, i do see this error in the log:

zwave-js-ui             | ValidationError: The 'X-Forwarded-For' header is set but the Express 'trust proxy' setting is false (default). This could indicate a misconfiguration which would prevent express-rate-limit from accurately identifying users. See https://express-rate-limit.github.io/ERR_ERL_UNEXPECTED_X_FORWARDED_FOR/ for more information.
zwave-js-ui             |     at Object.xForwardedForHeader (/usr/src/app/node_modules/express-rate-limit/dist/index.cjs:167:13)
zwave-js-ui             |     at Object.wrappedValidations.<computed> [as xForwardedForHeader] (/usr/src/app/node_modules/express-rate-limit/dist/index.cjs:362:22)
zwave-js-ui             |     at Object.keyGenerator (/usr/src/app/node_modules/express-rate-limit/dist/index.cjs:617:20)
zwave-js-ui             |     at /usr/src/app/node_modules/express-rate-limit/dist/index.cjs:669:32
zwave-js-ui             |     at /usr/src/app/node_modules/express-rate-limit/dist/index.cjs:649:5 {
zwave-js-ui             |   code: 'ERR_ERL_UNEXPECTED_X_FORWARDED_FOR',
zwave-js-ui             |   help: 'https://express-rate-limit.github.io/ERR_ERL_UNEXPECTED_X_FORWARDED_FOR/'
zwave-js-ui             | }

so probably somewhere in the config I should set a trust proxy setting... how can i do that?

(BTW functionality all works fine, i just also like when i have no errors in my log :-))

[robertsLando]

https://zwave-js.github.io/zwave-js-ui/#/guide/env-vars

TLDR;

TRUST_PROXY: Set this env in order to trust the proxy. See express behind proxies for more info about allowed values.

Set TRUST_PROXY env var to true

[akamming]

Nice, this solved the error indeed!

[git-developer]

Using Z-Wave JS UI 11.6.1, setting TRUST_PROXY to true causes the following log message:

ValidationError: The Express 'trust proxy' setting is true, which allows anyone to trivially bypass IP-based rate limiting. See https://express-rate-limit.github.io/ERR_ERL_PERMISSIVE_TRUST_PROXY/ for more information.
    at Object.trustProxy (file:///usr/src/app/node_modules/express-rate-limit/dist/index.mjs:121:13)
    at Object.wrappedValidations.<computed> [as trustProxy] (file:///usr/src/app/node_modules/express-rate-limit/dist/index.mjs:334:22)
    at Object.keyGenerator (file:///usr/src/app/node_modules/express-rate-limit/dist/index.mjs:588:20)
    at file:///usr/src/app/node_modules/express-rate-limit/dist/index.mjs:641:32
    at file:///usr/src/app/node_modules/express-rate-limit/dist/index.mjs:621:5 {
  code: 'ERR_ERL_PERMISSIVE_TRUST_PROXY',
  help: 'https://express-rate-limit.github.io/ERR_ERL_PERMISSIVE_TRUST_PROXY/'
}

According to the referenced documentation, the value should not be set to true but to the number of proxies.

Setting TRUST_PROXY to 1 solves the problem here.