From bb3f1451d3670da4e8536bc98a27a6a92b8acc2c Mon Sep 17 00:00:00 2001 From: Ritesh Jadhav Date: Sat, 26 Sep 2026 00:04:21 +0530 Subject: [PATCH] fix(cloudrun): resolve MongoDB driver TLS option parse error and allow container probes - Filtered out minTLSVersion metadata option when connecting via Mongoose to prevent MongoParseError: option mintlsversion is not supported - Allowed internal container probes without x-forwarded-proto while strictly blocking insecure proto === 'http' - Enabled trust proxy in Express for Cloud Run reverse proxy header support --- src/app.js | 1 + src/config/db.js | 5 ++++- src/middlewares/tlsGuard.middleware.js | 5 ++--- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/src/app.js b/src/app.js index 424b3f3..d0fabe1 100644 --- a/src/app.js +++ b/src/app.js @@ -10,6 +10,7 @@ import { tlsGuard } from './middlewares/tlsGuard.middleware.js'; import { config } from './config/env.js'; const app = express(); +app.set('trust proxy', true); // Security HTTP headers with TLS 1.2+ HSTS enforcement (SCRUM-151) app.use( diff --git a/src/config/db.js b/src/config/db.js index 975ef2b..b97f099 100644 --- a/src/config/db.js +++ b/src/config/db.js @@ -17,7 +17,10 @@ export const connectDB = async () => { config.mongoUri.includes('ssl=true') || config.nodeEnv === 'production'; - const connectionOptions = isRemote ? getMongoTlsOptions() : {}; + // Pass driver-supported TLS options to prevent MongoParseError while preserving TLS compliance metadata + const tlsConfig = getMongoTlsOptions(); + const driverTlsOptions = { tls: tlsConfig.tls }; + const connectionOptions = isRemote ? driverTlsOptions : {}; try { const conn = await mongoose.connect(config.mongoUri, connectionOptions); diff --git a/src/middlewares/tlsGuard.middleware.js b/src/middlewares/tlsGuard.middleware.js index 81e5349..4c077a7 100644 --- a/src/middlewares/tlsGuard.middleware.js +++ b/src/middlewares/tlsGuard.middleware.js @@ -17,10 +17,9 @@ export const tlsGuard = (req, res, next) => { // In production mode, enforce that traffic arrived via secure HTTPS proxy if (config.nodeEnv === 'production') { const proto = req.headers['x-forwarded-proto']; - const isEncrypted = Boolean(req.socket?.encrypted); - // If reverse proxy forwarded as plain HTTP and socket is not directly encrypted - if (proto === 'http' || (!proto && !isEncrypted)) { + // Block insecure plain HTTP forwarded by reverse proxy / load balancer + if (proto === 'http') { return ApiResponse.error( res, 'Forbidden: Insecure HTTP transport detected. HTTPS with TLS 1.2+ is strictly required for FinTrack AI.',