Fastify is created with trustProxy: true, which trusts EVERY proxy.

Why this matters

With unbounded trust Fastify believes the X-Forwarded-For and X-Forwarded-Proto headers on any incoming request, so a client can spoof its source IP (defeating IP allowlists, rate limiters, and audit logs) and spoof https, which can trick secure session cookies into being sent over plain HTTP.

Set trustProxy to the number of proxies actually in front of the app (Fastify({ trustProxy: 1 })), or to a specific address / subnet / preset ('loopback', a CIDR, or an allowlist array), so only your real infrastructure is trusted. Never trust all proxies.

import Fastify from 'fastify';

// ruleid: auth.fastify.trust-proxy-true
const fastify = Fastify({ trustProxy: true });

// ruleid: auth.fastify.trust-proxy-true
const app = Fastify({ logger: true, trustProxy: true });

import Fastify from 'fastify';

// ok: auth.fastify.trust-proxy-true -- bounded hop count (one proxy in front)
const fastify = Fastify({ trustProxy: 1 });

// ok: auth.fastify.trust-proxy-true -- a specific CIDR, not "all proxies"
const app = Fastify({ trustProxy: '127.0.0.1/8' });

// ok: auth.fastify.trust-proxy-true -- trust disabled entirely
const app2 = Fastify({ trustProxy: false });

// ok: auth.fastify.trust-proxy-true -- default construction, no proxy trust
const app3 = Fastify({ logger: true });

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.fastify.trust-proxy-true -- <reason>

References