Skip to content

Commit a2aa4e8

Browse files
chore: improve wording
1 parent d18f683 commit a2aa4e8

File tree

2 files changed

+41
-16
lines changed

2 files changed

+41
-16
lines changed

.swp

-12 KB
Binary file not shown.

content/security/rate-limiting.md

Lines changed: 41 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -103,26 +103,41 @@ findAll() {
103103

104104
#### Proxies
105105

106-
If your application runs behind a proxy server, check the specific HTTP adapter options ([express](http://expressjs.com/en/guide/behind-proxies.html) and [fastify](https://www.fastify.io/docs/latest/Reference/Server/#trustproxy)) for the `trust proxy` option and enable it.
107-
The following example enables `trust proxy` for the `express` adapter:
106+
If your application is running behind a proxy server, it’s essential to configure the HTTP adapter to trust the proxy. You can refer to the specific HTTP adapter options for [Express](http://expressjs.com/en/guide/behind-proxies.html) and [Fastify](https://www.fastify.io/docs/latest/Reference/Server/#trustproxy) to enable the `trust proxy` setting.
107+
108+
Here's an example that demonstrates how to enable `trust proxy` for the Express adapter:
108109

109110
```typescript
110-
//main.ts
111+
@@filename(main.ts)
111112
import { NestFactory } from '@nestjs/core';
112113
import { AppModule } from './app.module';
113-
import { NestExpressApplication } from "@nestjs/platform-express"
114+
import { NestExpressApplication } from '@nestjs/platform-express';
115+
114116
async function bootstrap() {
115117
const app = await NestFactory.create<NestExpressApplication>(AppModule);
116-
app.set('trust proxy', 'loopback') // specify a single subnet
117-
await app.listen(3000)
118+
app.set('trust proxy', 'loopback'); // Trust requests from the loopback address
119+
await app.listen(3000);
118120
}
121+
122+
bootstrap();
123+
@@switch
124+
import { NestFactory } from '@nestjs/core';
125+
import { AppModule } from './app.module';
126+
import { NestExpressApplication } from '@nestjs/platform-express';
127+
128+
async function bootstrap() {
129+
const app = await NestFactory.create(AppModule);
130+
app.set('trust proxy', 'loopback'); // Trust requests from the loopback address
131+
await app.listen(3000);
132+
}
133+
119134
bootstrap();
120135
```
121136

122-
Doing so will allow you to get the original IP address from the `X-Forwarded-For` header, and you can override the `getTracker()` method to pull the value from the header rather than from `req.ip`. The following example works with both express and fastify:
137+
Enabling `trust proxy` allows you to retrieve the original IP address from the `X-Forwarded-For` header. You can also customize the behavior of your application by overriding the `getTracker()` method to extract the IP address from this header instead of relying on `req.ip`. The following example demonstrates how to achieve this for both Express and Fastify:
123138

124139
```typescript
125-
// throttler-behind-proxy.guard.ts
140+
@@filename(throttler-behind-proxy.guard)
126141
import { ThrottlerGuard } from '@nestjs/throttler';
127142
import { Injectable } from '@nestjs/common';
128143

@@ -132,11 +147,6 @@ export class ThrottlerBehindProxyGuard extends ThrottlerGuard {
132147
return req.ips.length ? req.ips[0] : req.ip; // individualize IP extraction to meet your own needs
133148
}
134149
}
135-
136-
// app.controller.ts
137-
import { ThrottlerBehindProxyGuard } from './throttler-behind-proxy.guard';
138-
139-
@UseGuards(ThrottlerBehindProxyGuard)
140150
```
141151

142152
> info **Hint** You can find the API of the `req` Request object for express [here](https://expressjs.com/en/api.html#req.ips) and for fastify [here](https://www.fastify.io/docs/latest/Reference/Request/).
@@ -149,15 +159,30 @@ This module can work with websockets, but it requires some class extension. You
149159
@Injectable()
150160
export class WsThrottlerGuard extends ThrottlerGuard {
151161
async handleRequest(requestProps: ThrottlerRequest): Promise<boolean> {
152-
const { context, limit, ttl, throttler, blockDuration, getTracker, generateKey } = requestProps;
162+
const {
163+
context,
164+
limit,
165+
ttl,
166+
throttler,
167+
blockDuration,
168+
getTracker,
169+
generateKey,
170+
} = requestProps;
153171

154172
const client = context.switchToWs().getClient();
155173
const tracker = client._socket.remoteAddress;
156174
const key = generateKey(context, tracker, throttler.name);
157175
const { totalHits, timeToExpire, isBlocked, timeToBlockExpire } =
158-
await this.storageService.increment(key, ttl, limit, blockDuration, throttler.name);
176+
await this.storageService.increment(
177+
key,
178+
ttl,
179+
limit,
180+
blockDuration,
181+
throttler.name,
182+
);
159183

160-
const getThrottlerSuffix = (name: string) => (name === 'default' ? '' : `-${name}`);
184+
const getThrottlerSuffix = (name: string) =>
185+
name === 'default' ? '' : `-${name}`;
161186

162187
// Throw an error when the user reached their limit.
163188
if (isBlocked) {

0 commit comments

Comments
 (0)