Express Backend Configuration

Configure your Express backend to trust Relay edge limits.

Trusting Proxies

Because Relay sits between your users and your backend, your Express application will see the request as coming from Relay's IP address rather than the original client's IP. To ensure rate limiting and IP-based logic works correctly on your end (if needed), you must configure Express to trust the proxy.

Add the following configuration to your Express app:

Copy// Enable if you're behind a reverse proxy (like Relay) app.set('trust proxy', true);

Handling Client IPs

Relay automatically appends the original client IP to the x-forwarded-for header and explicitly sets the x-relay-client-ip header. You can use these headers to identify the real origin of the request.

x-forwarded-for: Standard header showing the originating IP address.
x-relay-client-ip: Relay-specific header for reliable IP identification.

Enforcing Relay Traffic

To prevent malicious actors from bypassing Relay and hitting your backend directly, you should write a middleware that rejects any requests that do not originate from Relay. You can do this by validating the presence of Relay-specific headers or by whitelisting Relay's IP addresses.

Copy// Middleware to ensure requests come from Relay const relayOnly = (req, res, next) => { // Relay sets this header when forwarding requests const clientIp = req.headers['x-relay-client-ip']; const forwardedFor = req.headers['x-forwarded-for']; if (!clientIp && !forwardedFor) { return res.status(403).json({ error: 'Direct access forbidden' }); } next(); }; app.use(relayOnly);