From 404a6ac0d45a404e98f06eed8209c29222059ca8 Mon Sep 17 00:00:00 2001
From: Daniel Dietzler <mail@ddietzler.dev>
Date: Mon, 23 Dec 2024 20:27:36 +0100
Subject: [PATCH] fix: trusted proxies

---
 server/src/repositories/config.repository.spec.ts | 2 +-
 server/src/repositories/config.repository.ts      | 2 +-
 server/src/workers/api.ts                         | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/server/src/repositories/config.repository.spec.ts b/server/src/repositories/config.repository.spec.ts
index 2ff5f53073..aa7fb87ac5 100644
--- a/server/src/repositories/config.repository.spec.ts
+++ b/server/src/repositories/config.repository.spec.ts
@@ -204,7 +204,7 @@ describe('getEnv', () => {
     it('should return default network options', () => {
       const { network } = getEnv();
       expect(network).toEqual({
-        trustedProxies: [],
+        trustedProxies: ['linklocal', 'uniquelocal'],
       });
     });
 
diff --git a/server/src/repositories/config.repository.ts b/server/src/repositories/config.repository.ts
index a8a1c9972b..cc05fd927c 100644
--- a/server/src/repositories/config.repository.ts
+++ b/server/src/repositories/config.repository.ts
@@ -177,7 +177,7 @@ const getEnv = (): EnvData => {
     licensePublicKey: isProd ? productionKeys : stagingKeys,
 
     network: {
-      trustedProxies: dto.IMMICH_TRUSTED_PROXIES ?? [],
+      trustedProxies: dto.IMMICH_TRUSTED_PROXIES ?? ['linklocal', 'uniquelocal'],
     },
 
     otel: {
diff --git a/server/src/workers/api.ts b/server/src/workers/api.ts
index 5196e7595c..efc705deaf 100644
--- a/server/src/workers/api.ts
+++ b/server/src/workers/api.ts
@@ -32,7 +32,7 @@ async function bootstrap() {
 
   logger.setContext('Bootstrap');
   app.useLogger(logger);
-  app.set('trust proxy', ['loopback', 'linklocal', 'uniquelocal', ...network.trustedProxies]);
+  app.set('trust proxy', ['loopback', ...network.trustedProxies]);
   app.set('etag', 'strong');
   app.use(cookieParser());
   app.use(json({ limit: '10mb' }));