GitbookIO / nuts

:chestnut: Releases/downloads server with auto-updater and GitHub as a backend
http://nuts.gitbook.com
Apache License 2.0
1.25k stars 300 forks source link

When proxy-ing the update server does not seem to use the X-Forwarded-Host for the windows Releases file #166

Open loneparadox opened 4 years ago

loneparadox commented 4 years ago

Running nuts behind apache load balancer.

The getFullUrl function uses req.get('host') to get the host to specify in the RELEASES file. If I understand https://expressjs.com/en/guide/behind-proxies.html correctly, It seems that express only updates req.hostname

I can confirm that behind the proxy that: req.hostname does return the X-Forwarded-Host when the trust proxy is enabled. But req.get('host') returns the name of the host in the request.

For example: If the the main url is updateserver.example.com which I balance to updateserver1.example.com and updateserver2.example.com

Then with the trust proxy enabled, the value of req.hostname is updateserver.example.com Where the req.get('host') has a value of updateserver1.example.com