baris@community.nodebb.orgStarting with 4.13.3, the default value of trust_proxy will be false on new installs to ensure a secure default setting.
An upgrade script will set the value to true if it is not found in config.json to prevent breaking existing installs.
The documentation is updated to reflect the change:
- trust_proxy (Default: false) Enables Express' proxy trust handling for req.ip and related values.
- Only set this to true when NodeBB is behind a reverse proxy that strips or overwrites untrusted X-Forwarded-For headers.
- If this is left unset, NodeBB will not trust forwarded client IP headers.
- For more information see expressjs docs https://expressjs.com/en/5x/guide/behind-proxies/
If you are upgrading from 4.13.2 and already use a proxy like nginx, you don't have to do anything. trust_proxy: true will be automatically set in config.json
If your nodebb was facing the public directly on port 4567(which isn't recommended). Remove trust_proxy from config.json OR set it to false via trust_proxy: false.
When you upgrade the upgrade script will add it or you can add it now like
"trust_proxy": trueif your nodebb is behind a proxy like nginx.