{"record":{"id":"b37d7eccfe3febc1","repo":"sveltejs/kit","slug":"env-prefix-xff-depth-is-xff-depth-but-only-f","errorCode":null,"errorMessage":"${env_prefix}XFF_DEPTH is ${xff_depth}, but only found ${addresses.length} addresses","messagePattern":"(.+?)XFF_DEPTH is (.+?), but only found (.+?) addresses","errorType":"http","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/adapter-bun/src/handler.js","lineNumber":118,"sourceCode":" * @returns {string}\n */\nfunction get_client_address(request, bun_server) {\n\tif (!address_header) {\n\t\t// requestIP() is null over unix sockets; undefined matches adapter-node\n\t\treturn /** @type {string} */ (bun_server.requestIP(request)?.address);\n\t}\n\n\tconst value = request.headers.get(address_header);\n\tif (value === null) {\n\t\tthrow new Error(\n\t\t\t`Address header was specified with ${env_prefix}ADDRESS_HEADER=${address_header} but is absent from request`\n\t\t);\n\t}\n\tif (address_header !== 'x-forwarded-for') return value;\n\n\tconst addresses = value.split(',');\n\tif (xff_depth > addresses.length) {\n\t\tthrow new Error(\n\t\t\t`${env_prefix}XFF_DEPTH is ${xff_depth}, but only found ${addresses.length} addresses`\n\t\t);\n\t}\n\treturn addresses[addresses.length - xff_depth].trim();\n}\n","sourceCodeStart":100,"sourceCodeEnd":124,"githubUrl":"https://github.com/sveltejs/kit/blob/03f1687fe612ce3d2d9131139b5b188d9cf90c64/packages/adapter-bun/src/handler.js#L100-L124","documentation":"When ADDRESS_HEADER=x-forwarded-for, the adapter walks the comma-separated address list from the right XFF_DEPTH entries to find the original client. If XFF_DEPTH exceeds the number of addresses actually present, the configured trust depth cannot be satisfied and it throws to avoid returning a proxy's IP as the client.","triggerScenarios":"XFF_DEPTH=2 (two proxy layers expected) but the request carries only one X-Forwarded-For entry; requests that reach the server without passing through all anticipated proxy layers.","commonSituations":"XFF_DEPTH tuned for production proxy chains but hit directly (health checks, local runs); clients that send their own single-entry X-Forwarded-For and a proxy that overwrites rather than appends.","solutions":["Lower XFF_DEPTH to match the actual number of trusted proxy hops (usually 1).","Ensure all proxies in the chain append to X-Forwarded-For rather than overwriting it.","Make direct-to-server traffic (health probes) go through the proxy chain or exempt it."],"exampleFix":"// env before\nXFF_DEPTH=3   # only 1 proxy in front\n// after\nXFF_DEPTH=1","handlingStrategy":"validation","validationCode":"const depth = Number(process.env.XFF_DEPTH || 1);\nconst count = (req.headers.get('x-forwarded-for') || '').split(',').filter(Boolean).length;\nif (depth > count) console.warn(`XFF_DEPTH=${depth} but only ${count} addresses present`);","typeGuard":null,"tryCatchPattern":"let ip;\ntry {\n  ip = getClientAddress(event);\n} catch (err) {\n  if (/only found .* addresses/.test(err.message)) {\n    ip = '0.0.0.0'; // fall back rather than trusting a proxy IP\n  } else throw err;\n}","preventionTips":["Set XFF_DEPTH to the true number of trusted proxy hops (usually 1).","Ensure each hop appends to X-Forwarded-For, never overwrites.","Route health checks through the same proxy chain or unset the header config for them."],"tags":["http-headers","proxy","adapter-bun","client-ip"],"backgroundTag":"xff-depth-mismatch","analyzedSha":"03f1687fe612ce3d2d9131139b5b188d9cf90c64","analyzedAt":"2026-09-02T02:01:50.504Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}