make the code compliant with legacy behavior

bluesky-social · Feb 24, 2025 · 8777b73 · 8777b73
1 parent 2af6887
commit 8777b73
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/packages/pds/src/context.ts b/packages/pds/src/context.ts
@@ -333,9 +333,9 @@ export class AppContext {
           dpopSecret: secrets.dpopSecret,
           customization: cfg.oauth.provider.customization,
           safeFetch,
-          // Assumes this server runs behind a proxy
-          // @TODO: Make this configurable
-          trustProxy: (addr: string, i: number) => i >= 1,
+          // @TODO: Make this configurable. The legacy implementation used to
+          // blindly trust the X-Forwarded-For header.
+          trustProxy: (_addr: string, _i: number) => true,
         })
       : undefined