ValidationError: The 'X-Forwarded-For' header is set but the Express

[arnabg95]

ValidationError: The 'X-Forwarded-For' header is set but the Express

[arnabg95]

Hum, it looks like it's cutting off the end of the error message in your screenshot - it should have a link to https://github.com/express-rate-limit/express-rate-limit/wiki/Error-Codes#err_erl_unexpected_x_forwarded_for

This error is logged when the X-Forwarded-For header is set (indicating use of a proxy), but the trust proxy setting is false (which is the default value).
This usually indicates a configuration issue that will cause express-rate-limit to apply it's limits global rather than on a per-user basis. Refer to the Troubleshooting Proxy Issues page for a guide to set the trust proxy value correctly.
If this error occurs only rarely, and you do not have a reverse proxy, it may indicate a malicious user probing for vulnerabilities.
This check will be prevented if a custom keyGenerator is supplied.

Basically, it looks like there is a reverse proxy in between your app and the internet, and you're rate-limiting it's IP rather than the end-user's IP.

Typically, calling app.set('trust proxy', 1); will solve this.

I went through the Troubleshooting Proxy Issues page and app.set('trust proxy', 2) this worked for me. thanks

[nfriedly]

Hum, it looks like it's cutting off the end of the error message in your screenshot - it should have a link to https://github.com/express-rate-limit/express-rate-limit/wiki/Error-Codes#err_erl_unexpected_x_forwarded_for

This error is logged when the X-Forwarded-For header is set (indicating use of a proxy), but the trust proxy setting is false (which is the default value).

This usually indicates a configuration issue that will cause express-rate-limit to apply it's limits global rather than on a per-user basis. Refer to the Troubleshooting Proxy Issues page for a guide to set the trust proxy value correctly.

If this error occurs only rarely, and you do not have a reverse proxy, it may indicate a malicious user probing for vulnerabilities.

This check will be prevented if a custom keyGenerator is supplied.

Basically, it looks like there is a reverse proxy in between your app and the internet, and you're rate-limiting it's IP rather than the end-user's IP.

Typically, calling app.set('trust proxy', 1); will solve this.