Set X-Forwarded-For in proxy

proxy/README.md

@@ -16,6 +16,7 @@ _See the [full architecture guide](../README.md) first._
 - Proxy allows only GET requests and HTTP/HTTPS protocols.
 - Proxy do not allow requests to in-cloud IP addresses like `127.0.0.1`.
 - Proxy removes cookie headers.
+- Proxy set user’s IP in `X-Forwarded-For` header.
 
 ## Test Strategy
 

proxy/proxy.ts

@@ -68,7 +68,8 @@ export function createProxyServer(config: {
       let targetResponse = await fetch(url, {
         headers: {
           ...(req.headers as HeadersInit),
-          host: new URL(url).host
+          'host': new URL(url).host,
+          'X-Forwarded-For': req.socket.remoteAddress!
         },
         method: req.method,
         signal: AbortSignal.timeout(config.timeout)

proxy/test/proxy.test.ts

@@ -133,3 +133,17 @@ test('checks Origin', async () => {
   })
   equal(response2.status, 400)
 })
+
+test('sends user IP to destination', async () => {
+  let response1 = await request(targetUrl)
+  equal(response1.status, 200)
+  let json1 = await response1.json()
+  equal(json1.request.headers['x-forwarded-for'], '::1')
+
+  let response2 = await request(targetUrl, {
+    headers: { 'X-Forwarded-For': '4.4.4.4' }
+  })
+  equal(response2.status, 200)
+  let json2 = await response2.json()
+  equal(json2.request.headers['x-forwarded-for'], '4.4.4.4, ::1')
+})