Untitled Lesson
Skill Matrix
UNLOCK NODES BY LEARNING NEW TAGS.
Why does a Node.js application need to explicitly configure `app.set("trust proxy", true)` when running behind an Nginx reverse proxy?
💻 Code Challenge | +75 XP
Write an Nginx configuration with TLS termination, static file serving from a /static/ path bypassing Node.js, proxying dynamic requests to a Node.js app with proper X-Forwarded headers, and basic rate limiting on an /api/ path.
An Express application running behind Nginx was logging every single request as coming from the same internal IP address, making it impossible to identify actual client traffic patterns or apply per-client rate limiting correctly. Reorder the steps to fix this.
Task: Reorder the blocks in logical sequence to solve the problem.
A.D.A. Interface
Adaptive Didactic Assistant
Pascual Vila
Frontend Instructor // Code Syllabus
The Error //
Running Node.js behind Nginx without configuring Express to trust the proxy's forwarded headers
// Wrong: req.ip is always Nginx's internal IP, not the real client's
const app = express();
// Correct: trusts the forwarded header from Nginx
app.set("trust proxy", true);The Solution //
Without app.set("trust proxy", true), Express treats the immediate connecting address (Nginx's own internal IP) as the client's address, ignoring the X-Forwarded-For header Nginx sets with the real originating client IP — this breaks anything relying on an accurate client IP, including rate limiting, geolocation, and audit logging.
The Error //
Configuring Nginx's proxy_read_timeout shorter than a legitimately slow Node.js operation can take
// Wrong: cuts off a request that legitimately needs more time
proxy_read_timeout 10s; // but this specific endpoint can genuinely take 30s
// Correct: accommodates the actual, legitimate operation duration
proxy_read_timeout 60s;The Solution //
If Nginx's configured timeout is shorter than how long a legitimate, correctly-functioning request can genuinely take to complete on the Node.js side, Nginx will terminate the connection prematurely, appearing to the client as a failure even though Node.js was still correctly processing the request.