Skip to content

Commit 4336d89

Browse files
docs(docs.nestjs.com) show example of enabling Throttle rate limiting behind proxies with express
the documentation was unsufficient to succesfuly implement the throttling since the external link to express suggested using 'app.set' method, wich by default throws 'property set does not exist` error
1 parent a5b8181 commit 4336d89

File tree

2 files changed

+17
-1
lines changed

2 files changed

+17
-1
lines changed

.swp

12 KB
Binary file not shown.

content/security/rate-limiting.md

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,23 @@ findAll() {
7272

7373
#### Proxies
7474

75-
If your application runs behind a proxy server, check the specific HTTP adapter options ([express](http://expressjs.com/en/guide/behind-proxies.html) and [fastify](https://www.fastify.io/docs/latest/Reference/Server/#trustproxy)) for the `trust proxy` option and enable it. Doing so will allow you to get the original IP address from the `X-Forwarded-For` header, and you can override the `getTracker()` method to pull the value from the header rather than from `req.ip`. The following example works with both express and fastify:
75+
If your application runs behind a proxy server, check the specific HTTP adapter options ([express](http://expressjs.com/en/guide/behind-proxies.html) and [fastify](https://www.fastify.io/docs/latest/Reference/Server/#trustproxy)) for the `trust proxy` option and enable it.
76+
Following example enables `trust proxy` for express adapter:
77+
78+
```typescript
79+
//main.ts
80+
import { NestFactory } from '@nestjs/core';
81+
import { AppModule } from './app.module';
82+
import { NestExpressApplication } from "@nestjs/platform-express"
83+
async function bootstrap() {
84+
const app = await NestFactory.create<NestExpressApplication>(AppModule);
85+
app.set('trust proxy', 'loopback') // specify a single subnet
86+
await app.listen(3000)
87+
}
88+
bootstrap();
89+
```
90+
91+
Doing so will allow you to get the original IP address from the `X-Forwarded-For` header, and you can override the `getTracker()` method to pull the value from the header rather than from `req.ip`. The following example works with both express and fastify:
7692

7793
```typescript
7894
// throttler-behind-proxy.guard.ts

0 commit comments

Comments
 (0)