fix(remix-express): respect expressjs hostname property when behind r…

…everse proxies (#7323)

Co-authored-by: Matt Brophy <[email protected]>

.changeset/fix-express-proxy.md

@@ -0,0 +1,7 @@
+---
+"@remix-run/express": patch
+---
+
+Allow the `@remix-run/express` adapter to work behind a proxy when using `app.enable('trust proxy')`
+ - Previously, this used `req.get('host')` to construct the Remix `Request`, but that does not respect `X-Forwarded-Host`
+ - This now uses `req.hostname` which will respect `X-Forwarded-Host`

packages/remix-express/server.ts

@@ -87,7 +87,14 @@ export function createRemixRequest(
   req: express.Request,
   res: express.Response
 ): Request {
-  let url = new URL(`${req.protocol}://${req.get("host")}${req.url}`);
+  // req.hostname doesn't include port information so grab that from 
+  // `X-Forwarded-Host` or `Host`
+  let [,hostnamePort] = req.get('X-Forwarded-Host')?.split(':') ?? [];
+  let [,hostPort] = req.get('host')?.split(':') ?? [];
+  let port = hostnamePort || hostPort;
+  // Use req.hostname here as it respects the "trust proxy" setting
+  let resolvedHost = `${req.hostname}${port ? `:${port}` : ""}`;
+  let url = new URL(`${req.protocol}://${resolvedHost}${req.url}`);
 
   // Abort action/loaders once we can no longer write a response
   let controller = new AbortController();