Express: Q: Why is hop count always 0?

[Domiii]

The protocol getter returns the value of the X-Forward-Proto header if the connection is to be trusted. For that, it considers the value passed to trust proxy (if given). The trust proxy value can be a number to represent the max trusted hop count. However in the current code, the number is ignored because in the protocol getter, it always passes a hardcoded 0 for the actual hop count here:

if (!trust(this.connection.remoteAddress, 0)) {

Why is hop count always 0 here? Isn't it dangerous to tell administrators that this setting will check against hop count, while it actually does not?

[dougwilson]

The socket address is always hop count 0. The first proxy would be count 1 and so on, but the function is called giving the value of the 0th hop in your example (the socket address).

[dougwilson]

If you truly believe there is something security related, please follow the report procedure outlined at https://github.com/expressjs/express/blob/master/Security.md

[Domiii]

Thank you for the clarification!