fix(@angular/ssr): add support for configuring trusted proxy headers via environment variable - #33273
Conversation
…via environment variable Adds support for configuring trusted proxy headers via the `NG_TRUST_PROXY_HEADERS` environment variable in `AngularNodeAppEngine`. This allows users to specify which proxy headers (such as `X-Forwarded-Host`) should be trusted when running the server-side application behind a reverse proxy, without needing to modify the application code. The environment variable accepts a comma-separated list of header names. If the `NG_TRUST_PROXY_HEADERS` environment variable is set and contains non-empty values, it will take precedence over the `trustProxyHeaders` option provided programmatically in the `AngularNodeAppEngine` constructor options. (cherry picked from commit 126b19b)
There was a problem hiding this comment.
Code Review
This pull request refactors environment options parsing and introduces support for the NG_TRUST_PROXY_HEADERS environment variable. However, the changes alter the behavior of allowedHosts by overriding programmatic options with environment variables instead of merging them, which could cause breaking changes. Additionally, NG_TRUST_PROXY_HEADERS should be updated to correctly parse boolean values ('true'/'false') instead of treating them as single-item string arrays.
|
This PR was merged into the repository. The changes were merged into the following branches:
|
|
This pull request has been automatically locked due to inactivity. Read more about our automatic conversation locking policy. This action has been performed automatically by a bot. |
This is a v19 port of #33056.
Adds support for configuring trusted proxy headers via the
NG_TRUST_PROXY_HEADERSenvironment variable inAngularNodeAppEngine. This allows users to specify which proxy headers (such asX-Forwarded-Host) should be trusted when running the server-side application behind a reverse proxy, without needing to modify the application code. The environment variable accepts a comma-separated list of header names. If theNG_TRUST_PROXY_HEADERSenvironment variable is set and contains non-empty values, it will take precedence over thetrustProxyHeadersoption provided programmatically in theAngularNodeAppEngineconstructor options.(cherry picked from commit 126b19b)