Nitro · NITRO0004
Use request IP utilities instead of raw IP headers
Request-sensitive Nitro code should not trust client-controlled forwarding headers directly.
nitro/request/prefer-get-request-ipsrc/rule-packs/nitro/rules/prefer-get-request-ip.ts Upstream docs Run this rule
pnpm vite-doctor . --framework nitro --rules nitro/request/prefer-get-request-ip
Why it matters
Reading x-forwarded-for directly trusts raw proxy input and may return a spoofed or comma-separated value instead of the client address.
Recommended fix
Use the H3/Nitro request IP utility and centralize trusted proxy handling instead of reading IP headers directly.
Useful links
Example
Use getRequestIP
Before
export default defineEventHandler((event) => {
return getHeader(event, 'x-forwarded-for')
})
After
export default defineEventHandler((event) => {
return getRequestIP(event, { xForwardedFor: true })
})