Issues with dSpace10.0 installation behind IIS reverse proxy

[Vincent B.]

Hi everyone,

I have been scratching my head about two frontend issues for hours.

- ERR_INVALID_ADDRESS

- Some localhost remaining in main.js

This is my first installation of dSpace. Here are some infromations about the server

- Windows server 2022

- nvm 24.15.0

- using pm2 and environment variables and node.exe for debug

- IIS (10.0.xxxx)) reverse proxy with HTTPS

Here is my dspace-ui.json

{
    "apps": [
        {
           "name": "dspace-ui",
           "cwd": "E:\\dspace-ui-deploy",
           "script": "dist\\server\\main.js",
           "instances": "max",
           "exec_mode": "cluster",
           "env": {
              "NODE_ENV": "production",
              "DSPACE_UI_SSL" : "false",
              "DSPACE_UI_HOST" : "127.0.0.1",
              "DSPACE_UI_PORT": "4000",
              "DSPACE_UI_SSL" : "false",
              "DSPACE_UI_NAMESPACE" : "/",
              "DSPACE_UI_SSL" : "false",
              "DSPACE_UI_BASEURL" : "https://[our frontend url]",
              "DSPACE_REST_SSL" : "true",
              "DSPACE_REST_HOST" : "[our backend url]",
              "DSPACE_REST_PORT" : "443",
              "DSPACE_REST_NAMESPACE" : "/server",
           }
        }
    ]
}

Those are replicated in Windows environment variables.

After build and copying the built code to dspace-ui-deploy-dist I have two errors.

First is related to having the port in the forwarded IP.

ValidationError: An invalid 'request.ip' (192.168.24.13:54170) was detected. Consider passing a custom 'keyGenerator' function to the rate limiter. See https://express-rate-limit.github.io/ERR_ERL_INVALID_IP_ADDRESS/ for more information.
    at Object.ip (E:\dspace-ui-deploy\dist\server\main.js:1:3829713)
    at Object.wrappedValidations.<computed> [as ip] (E:\dspace-ui-deploy\dist\server\main.js:1:3837557)
    at E:\dspace-ui-deploy\dist\server\main.js:1:3839154
    at Generator.next (<anonymous>)
    at asyncGeneratorStep (E:\dspace-ui-deploy\dist\server\main.js:1:3806369)
    at _next (E:\dspace-ui-deploy\dist\server\main.js:1:3806609)
    at E:\dspace-ui-deploy\dist\server\main.js:1:3806728
    at new ZoneAwarePromise (E:\dspace-ui-deploy\dist\server\main.js:1:3716681)
    at E:\dspace-ui-deploy\dist\server\main.js:1:3806545
    at Object.keyGenerator (E:\dspace-ui-deploy\dist\server\main.js:1:3839558) {
  code: 'ERR_ERL_INVALID_IP_ADDRESS',
  help: 'https://express-rate-limit.github.io/ERR_ERL_INVALID_IP_ADDRESS/'
}

The issue is I have no idea where to set up this custom KeyGenerator to strip the IP from the port. Or should I fix it at reverse proxy level?

Second issue is more troublesome.

ERROR: URL with hostname "localhost" is not allowed.Please provide a list of allowed hosts in the "allowedHosts" option in the "CommonEngine" constructor.
Error in server-side rendering (SSR)
Error details :  Error: URL with hostname "localhost" is not allowed.
    at validateUrl (E:\dspace-ui-deploy\dist\server\main.js:1:8227592)
    at E:\dspace-ui-deploy\dist\server\main.js:1:8227653
    at Generator.next (<anonymous>)
    at asyncGeneratorStep (E:\dspace-ui-deploy\dist\server\main.js:1:3993125)
    at _next (E:\dspace-ui-deploy\dist\server\main.js:1:3993350)
    at E:\dspace-ui-deploy\dist\server\main.js:1:3993469
    at new ZoneAwarePromise (E:\dspace-ui-deploy\dist\server\main.js:1:3716681)
    at E:\dspace-ui-deploy\dist\server\main.js:1:3993286
    at CommonEngine.render (E:\dspace-ui-deploy\dist\server\main.js:1:8229294)
    at serverSideRender (E:\dspace-ui-deploy\dist\server\main.js:1:8242424)
Falling back to serving direct client-side rendering (CSR).
GET /home 200 12.333 ms - 1115
Error: URL with hostname "localhost" is not allowed.
    at validateUrl (E:\dspace-ui-deploy\dist\server\main.js:1:8227592)
    at E:\dspace-ui-deploy\dist\server\main.js:1:8227653
    at Generator.next (<anonymous>)
    at asyncGeneratorStep (E:\dspace-ui-deploy\dist\server\main.js:1:3993125)
    at _next (E:\dspace-ui-deploy\dist\server\main.js:1:3993350)
    at E:\dspace-ui-deploy\dist\server\main.js:1:3993469
    at new ZoneAwarePromise (E:\dspace-ui-deploy\dist\server\main.js:1:3716681)
    at E:\dspace-ui-deploy\dist\server\main.js:1:3993286
    at CommonEngine.render (E:\dspace-ui-deploy\dist\server\main.js:1:8229294)
    at serverSideRender (E:\dspace-ui-deploy\dist\server\main.js:1:8242424)
ERROR: URL with hostname "localhost" is not allowed.Please provide a list of allowed hosts in the "allowedHosts" option in the "CommonEngine" constructor.
Error in server-side rendering (SSR)
Error details :  Error: URL with hostname "localhost" is not allowed.
    at validateUrl (E:\dspace-ui-deploy\dist\server\main.js:1:8227592)
    at E:\dspace-ui-deploy\dist\server\main.js:1:8227653
    at Generator.next (<anonymous>)
    at asyncGeneratorStep (E:\dspace-ui-deploy\dist\server\main.js:1:3993125)
    at _next (E:\dspace-ui-deploy\dist\server\main.js:1:3993350)
    at E:\dspace-ui-deploy\dist\server\main.js:1:3993469
    at new ZoneAwarePromise (E:\dspace-ui-deploy\dist\server\main.js:1:3716681)
    at E:\dspace-ui-deploy\dist\server\main.js:1:3993286
    at CommonEngine.render (E:\dspace-ui-deploy\dist\server\main.js:1:8229294)
    at serverSideRender (E:\dspace-ui-deploy\dist\server\main.js:1:8242424)
Falling back to serving direct client-side rendering (CSR).

I checked all my configuration variables and they are consistent with the dspce-ui.json.

I still get some calls to localhost from main.js

Like here,

 ...       

class sU {
            constructor() {
                this.production = !1,
                this.debug = !1,
                this.ui = {
                    ssl: !1,
                    host: "localhost",
                    port: 4e3,
                    nameSpace: "/",
                    baseUrl: "http://localhost:4000",
                    rateLimiter: {
                        windowMs: 6e4,
                        limit: 500,
                        ipv6Subnet: 56
                    },
                    useProxies: !0
                },

...

The generated config.json  seems correct

  "ui": {
    "ssl": false,
    "host": "localhost",
    "port": 4000,
    "nameSpace": "/",
    "baseUrl": "https://[our frontend url] "
  }
}

Does anyone have an idea of why I get those localhost in the main.js and what could be the root of the problem?

Thanks a lot.

Best,

Vincent