Configure Express trust proxy for Cloud Run / reverse proxy deployments

[Copilot]

Without trust proxy set, Express ignores X-Forwarded-For and resolves req.ip to the proxy's address—breaking IP-based rate limiting and audit logging when running behind Cloud Run or any reverse proxy.

Change

• server.ts: Add app.set("trust proxy", 1) immediately after app instantiation so Express correctly derives client IPs from the forwarded header chain.

const app = express();
const PORT = Number(process.env.PORT) || 3000;

app.set("trust proxy", 1); // trust single Cloud Run hop
app.use(express.json());
app.use(cookieParser());

[Copilot]

Pull request overview

This PR configures the Express server to correctly resolve client IP addresses (via req.ip) when deployed behind Cloud Run or another reverse proxy, so IP-based logging/rate-limiting logic works as intended.

Changes:

• Set Express trust proxy to 1 immediately after app creation to honor forwarded IP headers behind a single proxy hop.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.