# X_TRUST_PROXY_UNSET

## Means

proxy headers are trusted without saying how many proxies are in front

## Typical cause

`trustProxy: true` with no `trustedProxyHops`. The leftmost `x-forwarded-for` entry is whatever the client typed, so without a hop count there is no way to tell the proxy's entry from the caller's — and every per-ip limit and lockout is then keyed on an address the caller chooses. Asked at `defineHttpConfig` in the same shape as `X_RATE_LIMIT_NOT_SHARED`, because only the app knows its own topology. Both keys are **boot-owned** and `configureHttp()` type-refuses them: a framework-booted process reads the hop count from the ENVIRONMENT, because one image runs behind an ingress in one cluster and behind nothing on a laptop

## Fix

set `TRUSTED_PROXY_HOPS` in the deployment environment to the number of proxies that append to `x-forwarded-for` — 1 for a single ingress or ALB, 2 for a CDN in front of one — and leave it unset for a process reached directly (`trustedHopsFromEnv`, [`packages/cli/src/role-start.ts`](https://github.com/developerz-ai/ultimate/blob/main/packages/cli/src/role-start.ts)). An embedder calling `defineHttpConfig` itself passes `{ trustProxy: true, trustedProxyHops: 1 }`

[HTTP](/error-codes#http)