From 637605a002b602cc2b038abc9de9eda9630e2028 Mon Sep 17 00:00:00 2001
From: Wyatt Johnson <wyattjoh@gmail.com>
Date: Thu, 12 Dec 2019 22:50:00 +0000
Subject: [PATCH] fix: added trust proxy config (#2751)

---
 app.js       | 28 ++++++++++++++++++++++++++--
 config.js    |  3 +++
 package.json |  2 +-
 3 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/app.js b/app.js
index b3400b939..fd15eece2 100644
--- a/app.js
+++ b/app.js
@@ -11,7 +11,12 @@ const { HELMET_CONFIGURATION } = require('./config');
 const { MOUNT_PATH } = require('./url');
 const routes = require('./routes');
 const debug = require('debug')('talk:app');
-const { ENABLE_TRACING, APOLLO_ENGINE_KEY, PORT } = require('./config');
+const {
+  ENABLE_TRACING,
+  APOLLO_ENGINE_KEY,
+  PORT,
+  TRUST_PROXY,
+} = require('./config');
 
 const app = express();
 
@@ -58,7 +63,26 @@ if (ENABLE_TRACING && APOLLO_ENGINE_KEY) {
 
 // Trust the first proxy in front of us, this will enable us to trust the fact
 // that SSL was terminated correctly.
-app.set('trust proxy', 1);
+app.set(
+  'trust proxy',
+  (function() {
+    if (!TRUST_PROXY) {
+      return null;
+    }
+
+    const lowercase = TRUST_PROXY.toLowerCase();
+    if (lowercase === 'true' || lowercase === 'false') {
+      return lowercase === 'true';
+    }
+
+    const parsed = Number(TRUST_PROXY);
+    if (!isNaN(parsed)) {
+      return parsed;
+    }
+
+    return TRUST_PROXY;
+  })()
+);
 
 // Enable a suite of security good practices through helmet. We disable
 // frameguard to allow crossdomain injection of the embed.
diff --git a/config.js b/config.js
index 47ff1dcad..510213b76 100644
--- a/config.js
+++ b/config.js
@@ -85,6 +85,9 @@ const CONFIG = {
   // as report CSP violations.
   ENABLE_STRICT_CSP: process.env.TALK_ENABLE_STRICT_CSP === 'TRUE',
 
+  // TRUST_PROXY allows control over the `trust proxy` configuration on express.
+  TRUST_PROXY: process.env.TALK_TRUST_PROXY || '1',
+
   // LOGGING_LEVEL specifies the logging level used by the bunyan logger.
   LOGGING_LEVEL: ['fatal', 'error', 'warn', 'info', 'debug', 'trace'].includes(
     process.env.TALK_LOGGING_LEVEL
diff --git a/package.json b/package.json
index 8810a503b..5e64b6d20 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "talk",
-  "version": "4.11.2",
+  "version": "4.11.3",
   "description": "A better commenting experience from Vox Media.",
   "main": "app.js",
   "private": true,