add backend.trustProxy

Signed-off-by: Fredrik Adelöw <freben@gmail.com>

.changeset/plain-groups-sleep.md

@@ -0,0 +1,17 @@
+---
+'@backstage/backend-defaults': patch
+---
+
+Added an optional `backend.trustProxy` app config value, which sets the
+corresponding [Express.js `trust proxy`](https://expressjs.com/en/guide/behind-proxies.html) setting. This lets
+you easily configure proxy trust without making a custom `configure` callback
+for the `rootHttpRouter` service.
+
+If you already are using a custom `configure` callback, and if that also _does not_ call `applyDefaults()`, you may want to add the following to it:
+
+```ts
+const trustProxy = config.getOptional('backend.trustProxy');
+if (trustProxy !== undefined) {
+  app.set('trust proxy', trustProxy);
+}
+```

packages/backend-defaults/config.d.ts

@@ -51,6 +51,19 @@ export interface Config {
       serverShutdownDelay?: string | HumanDuration;
     };
 
+    /**
+     * Corresponds to the Express `trust proxy` setting.
+     *
+     * @see https://expressjs.com/en/guide/behind-proxies.html
+     * @remarks
+     *
+     * This setting is used to determine whether the backend should trust the
+     * `X-Forwarded-*` headers that are set by proxies. This is important for
+     * determining the original client IP address and protocol (HTTP/HTTPS) when
+     * the backend is behind a reverse proxy or load balancer.
+     */
+    trustProxy?: boolean | number | string | string[];
+
     /** Address that the backend should listen to. */
     listen?:
       | string

packages/backend-defaults/src/entrypoints/rootHttpRouter/rootHttpRouterServiceFactory.ts

@@ -87,6 +87,8 @@ const rootHttpRouterServiceFactoryWithOptions = (
       const logger = rootLogger.child({ service: 'rootHttpRouter' });
       const app = express();
 
+      const trustProxy = config.getOptional('backend.trustProxy');
+
       const router = DefaultRootHttpRouter.create({ indexPath });
       const middleware = MiddlewareFactory.create({ config, logger });
       const routes = router.handler();
@@ -112,6 +114,9 @@ const rootHttpRouterServiceFactoryWithOptions = (
           if (process.env.NODE_ENV === 'development') {
             app.set('json spaces', 2);
           }
+          if (trustProxy !== undefined) {
+            app.set('trust proxy', trustProxy);
+          }
           app.use(middleware.helmet());
           app.use(middleware.cors());
           app.use(middleware.compression());