From 064082f2a2aa1c801335b05ad0fde75f6f09f8e4 Mon Sep 17 00:00:00 2001 From: daedalus <44623501+ComfortablyCoding@users.noreply.github.com> Date: Fri, 5 Jun 2026 18:05:37 -0400 Subject: [PATCH] update IP_TRUST_PROXY --- content/configuration/security-limits.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/configuration/security-limits.md b/content/configuration/security-limits.md index e790d151..3a907d57 100644 --- a/content/configuration/security-limits.md +++ b/content/configuration/security-limits.md @@ -32,7 +32,7 @@ This page documents environment variables. For in-app security configuration (pe | `USER_INVITE_TOKEN_TTL` | The duration that the invite token is valid. | `7d` | | `USER_INVITE_URL_ALLOW_LIST` | List of URLs that can be used as `invite_url` in the `/users/invite` endpoint. | | | `USER_REGISTER_URL_ALLOW_LIST` | List of URLs that can be used as `verification_url` in the `/users/register` endpoint. | | -| `IP_TRUST_PROXY` | Settings for the Express.js trust proxy setting. | true | +| `IP_TRUST_PROXY` | Settings for the Express.js trust proxy setting. | false | | `IP_CUSTOM_HEADER` | What custom request header to use for the IP address. | false | | `IMPORT_IP_DENY_LIST`[2] | Deny importing files from these IP addresses / IP ranges / CIDR blocks. Use `0.0.0.0` to match any local IP address. | `0.0.0.0,169.254.169.254` | | `HSTS_ENABLED` | Enable the Strict-Transport-Security policy header. When enabled, Directus will send the `Strict-Transport-Security: max-age=15552000; includeSubDomains` header on all responses. | `false` |