diff --git a/.changeset/trust-proxy-client-address.md b/.changeset/trust-proxy-client-address.md deleted file mode 100644 index c959341..0000000 --- a/.changeset/trust-proxy-client-address.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -'seamless-auth-api': patch ---- - -Add `TRUST_PROXY` so the client address can be read from `X-Forwarded-For`. - -Express leaves `trust proxy` off by default, so behind a load balancer `req.ip` resolved to the -balancer rather than the caller. Every client shared one bucket in the global rate limiter and the -slow-down middleware, and `express-rate-limit` logged an `ERR_ERL_UNEXPECTED_X_FORWARDED_FOR` -validation error on each request. Set `TRUST_PROXY` to the number of proxies in front of the server -(`1` behind a single load balancer) to restore per-client limiting. It stays unset by default -because a directly reachable server that trusts the header lets a client forge its own address. diff --git a/CHANGELOG.md b/CHANGELOG.md index bdae9ff..12dd8f2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,18 @@ # seamless-auth-api +## 0.7.4 + +### Patch Changes + +- 7b8b6c2: Add `TRUST_PROXY` so the client address can be read from `X-Forwarded-For`. + + Express leaves `trust proxy` off by default, so behind a load balancer `req.ip` resolved to the + balancer rather than the caller. Every client shared one bucket in the global rate limiter and the + slow-down middleware, and `express-rate-limit` logged an `ERR_ERL_UNEXPECTED_X_FORWARDED_FOR` + validation error on each request. Set `TRUST_PROXY` to the number of proxies in front of the server + (`1` behind a single load balancer) to restore per-client limiting. It stays unset by default + because a directly reachable server that trusts the header lets a client forge its own address. + ## 0.7.3 ### Patch Changes diff --git a/package.json b/package.json index cf4da24..d9ab10b 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "seamless-auth-api", - "version": "0.7.3", + "version": "0.7.4", "description": "Seamless Auth API - A web application server for supporting a Seamless Auth server instance.", "main": "index.js", "type": "module",