fix: coerce TRUST_PROXY to integer before passing to Express

TheLastCicada · TheLastCicada · commit b3315eacf186 · 2026-05-08T12:51:38.000-07:00
diff --git a/src/middleware.js b/src/middleware.js
@@ -55,7 +55,7 @@ const app = express();
 // This also silences the express-rate-limit ValidationError that fires
 // when X-Forwarded-For is present but trust proxy is disabled.
 // Never use `true`; it trusts the user-supplied leftmost IP.
-const trustProxy = getConfig().APP.TRUST_PROXY ?? 0;
+const trustProxy = parseInt(getConfig().APP.TRUST_PROXY ?? 0, 10);
 app.set('trust proxy', trustProxy);
 
 app.use(
