{"record":{"id":"a05c9a0be916a2eb","repo":"sveltejs/kit","slug":"env-prefix-xff-depth-is-xff-depth-but-o","errorCode":null,"errorMessage":"${env_prefix + 'XFF_DEPTH'} is ${xff_depth}, but only found ${addresses.length} addresses","messagePattern":"(.+?) is (.+?), but only found (.+?) addresses","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/adapter-node/src/handler.js","lineNumber":168,"sourceCode":"\t\t\t\tif (!(address_header in req.headers)) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`Address header was specified with ${\n\t\t\t\t\t\t\tenv_prefix + 'ADDRESS_HEADER'\n\t\t\t\t\t\t}=${address_header} but is absent from request`\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\tconst value = /** @type {string} */ (req.headers[address_header]) || '';\n\n\t\t\t\tif (address_header === 'x-forwarded-for') {\n\t\t\t\t\tconst addresses = value.split(',');\n\n\t\t\t\t\tif (xff_depth < 1) {\n\t\t\t\t\t\tthrow new Error(`${env_prefix + 'XFF_DEPTH'} must be a positive integer`);\n\t\t\t\t\t}\n\n\t\t\t\t\tif (xff_depth > addresses.length) {\n\t\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t\t`${env_prefix + 'XFF_DEPTH'} is ${xff_depth}, but only found ${\n\t\t\t\t\t\t\t\taddresses.length\n\t\t\t\t\t\t\t} addresses`\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t\treturn addresses[addresses.length - xff_depth].trim();\n\t\t\t\t}\n\n\t\t\t\treturn value;\n\t\t\t}\n\n\t\t\treturn (\n\t\t\t\treq.connection?.remoteAddress ||\n\t\t\t\t// @ts-expect-error\n\t\t\t\treq.connection?.socket?.remoteAddress ||\n\t\t\t\treq.socket?.remoteAddress ||\n\t\t\t\t// @ts-expect-error\n\t\t\t\treq.info?.remoteAddress","sourceCodeStart":150,"sourceCodeEnd":186,"githubUrl":"https://github.com/sveltejs/kit/blob/03f1687fe612ce3d2d9131139b5b188d9cf90c64/packages/adapter-node/src/handler.js#L150-L186","documentation":"When reading the client address from x-forwarded-for, XFF_DEPTH entries are counted from the right of the comma-separated list. If the header contains fewer addresses than XFF_DEPTH, the server cannot identify the real client and throws.","triggerScenarios":"A request arrives whose x-forwarded-for header has, say, 1 address, but XFF_DEPTH=2 (or higher), so indexing addresses[addresses.length - xff_depth] would be invalid.","commonSituations":"Increasing XFF_DEPTH to match one production proxy chain while local/staging requests bypass those proxies and carry fewer hops.","solutions":["Lower XFF_DEPTH to a value less than or equal to the number of addresses your proxy chain always appends","Ensure all requests flow through the full proxy chain so x-forwarded-for has enough entries","Unset XFF_DEPTH (defaults to 1) if the topology is variable"],"exampleFix":"// before\nXFF_DEPTH=3\n// after\nXFF_DEPTH=1","handlingStrategy":"fallback","validationCode":"const depth = Number(process.env.XFF_DEPTH ?? 1);\nconst sample = req.headers['x-forwarded-for'] || '';\nif (depth > sample.split(',').length) {\n  console.warn('XFF_DEPTH exceeds number of x-forwarded-for entries for this path');\n}","typeGuard":"null","tryCatchPattern":"try {\n  const addr = getClientAddress();\n} catch (err) {\n  if (String(err.message).includes('but only found')) {\n    console.error('Request bypassed some proxies; lower XFF_DEPTH or route through full chain');\n  } else {\n    throw err;\n  }\n}","preventionTips":["Ensure all traffic traverses the full proxy chain, including health checks","Match XFF_DEPTH to the minimum number of proxies every request passes","Test from staging/local networks where hop counts differ"],"tags":["http","headers","proxy"],"backgroundTag":"xff-depth-exceeds-proxies","analyzedSha":"03f1687fe612ce3d2d9131139b5b188d9cf90c64","analyzedAt":"2026-09-02T02:01:50.504Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}