Skip to content

feat: add trustProxy option to respect X-Forwarded-* headers#3757

Merged
bartlomieju merged 4 commits intomainfrom
feat/trust-proxy
Apr 9, 2026
Merged

feat: add trustProxy option to respect X-Forwarded-* headers#3757
bartlomieju merged 4 commits intomainfrom
feat/trust-proxy

Conversation

@bartlomieju
Copy link
Copy Markdown
Member

Summary

  • Adds trustProxy option to FreshConfig (default: false)
  • When enabled, the handler reads X-Forwarded-Proto and X-Forwarded-Host headers and rewrites ctx.url so it reflects the actual client-facing URL
  • Useful for apps running behind nginx, Caddy, or other reverse proxies where ctx.url would otherwise return http:// instead of https://

Closes #2660

Usage

const app = new App({ trustProxy: true });

Test plan

  • With trustProxy: true, send a request with X-Forwarded-Proto: https and X-Forwarded-Host: example.com — verify ctx.url reflects https://example.com/...
  • With trustProxy: false (default), same headers are ignored — ctx.url uses the original request URL
  • Type checks pass

🤖 Generated with Claude Code

bartlomieju and others added 2 commits April 8, 2026 19:33
Adds a `trustProxy` config option. When enabled, the request handler
reads `X-Forwarded-Proto` and `X-Forwarded-Host` headers and rewrites
`ctx.url` accordingly, so applications behind a reverse proxy get the
correct protocol and hostname.

Closes #2660

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Comment thread packages/fresh/src/config.ts
bartlomieju and others added 2 commits April 9, 2026 09:45
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@bartlomieju bartlomieju enabled auto-merge (squash) April 9, 2026 07:50
@bartlomieju bartlomieju merged commit 07878fc into main Apr 9, 2026
9 checks passed
@bartlomieju bartlomieju deleted the feat/trust-proxy branch April 9, 2026 07:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Option to let Fresh respect X-Forwarded-* headers?

1 participant