`req.headers.host` is the standard, but yeah, proxies break it.
For nodejs request source hostname, I’d suggest:
1. Check `x-forwarded-host` first.
2. Fall back to `host`.
3. Validate the value if security matters.
Here’s a quick example:
```javascript
const host = req.headers['x-forwarded-host'] || req.headers.host;
if (!isValidHost(host)) throw new Error('Invalid host');
```
For nodejs request source hostname, I’d suggest:
1. Check `x-forwarded-host` first.
2. Fall back to `host`.
3. Validate the value if security matters.
Here’s a quick example:
```javascript
const host = req.headers['x-forwarded-host'] || req.headers.host;
if (!isValidHost(host)) throw new Error('Invalid host');
```
