The bug

We document IMMICH_TRUSTED_PROXIES in the docs. As far as I can tell this was added in #11286 , with the main effect being

- app.set('trust proxy', ['loopback', 'linklocal', 'uniquelocal']);
+ app.set('trust proxy', ['loopback', 'linklocal', 'uniquelocal', ...trustedProxies]);

However, I don't think that this does anything.

Testing:

• added IMMICH_TRUSTED_PROXIES as a random IP (not in my subnet)
• restart Immich
• Immich works fine through my reverse proxy, even login attempts are logged with the X-Forwarded-Host IP, not the internal container IP

For now, I will PR to remove this feature from our docs. Long term, we should enforce only accepting headers from an IP that is actually whitelisted as a trusted proxy.

The OS that Immich Server is running on

Debian

Version of Immich Server

1.123.0

Version of Immich Mobile App

1.123.0

Platform with the issue

• Server
• Web
• Mobile

Your docker-compose.yml content

N/A

Your .env content

N/A

Reproduction steps

as above

Relevant log output

No response

Additional information

No response