Nitro · Request
NITRO0004Use request IP utilities instead of raw IP headers
Request-sensitive Nitro code should not trust client-controlled forwarding headers directly.
vite-doctor/nitrorequestwarnSuggestion
Why it happens
Reading x-forwarded-for directly trusts raw proxy input and may return a spoofed or comma-separated value instead of the client address.
Fix
Use the H3/Nitro request IP utility and centralize trusted proxy handling instead of reading IP headers directly.
Example
Use getRequestIP
Before
export default defineEventHandler((event) => {
return getHeader(event, 'x-forwarded-for')
})
After
export default defineEventHandler((event) => {
return getRequestIP(event, { xForwardedFor: true })
})
Verify the fix
Run only this rule after editing so the report stays focused on the diagnostic you are closing:
pnpm vite-doctor . --framework nitro --rules nitro/request/prefer-get-request-ip