Proxy with Express

Two Express routes relay the script and events, using Node's built-in fetch.

Set it up

1. Add the routes

   Add the two routes to your existing app, before any catch-all route. Node.js 18 or later is required for fetch.

   metricraven-proxy.js

   Copy

   1

   2

   3

   4

   5

   6

   7

   8

   9

   10

   11

   12

   13

   14

   15

   16

   17

   18

   19

   20

   21

   22

   23

   24

   25

   26

   27

   28

   29

   30

   31

   32

   33

   34

   35

   36

   37

   38

   39

   // metricraven-proxy.js · Express 4 or 5 on Node.js 18+
   import express from "express";
   
   const app = express();
   // Behind a load balancer or CDN? Trust it so req.ip is the visitor, not the balancer.
   // app.set("trust proxy", 1);
   
   async function relay(req, res, url, cacheControl) {
     const headers = { "x-visitor-ip": req.ip.replace(/^::ffff:/, "") };
     for (const name of ["content-type", "origin", "user-agent"]) {
       if (req.headers[name]) headers[name] = req.headers[name];
     }
     try {
       const upstream = await fetch(url, {
         method: req.method,
         headers,
         body: req.method === "POST" ? req.body : undefined,
         signal: AbortSignal.timeout(15000),
       });
       res
         .status(upstream.status)
         .set("Content-Type", upstream.headers.get("content-type") || "application/octet-stream")
         .set("Cache-Control", cacheControl)
         .send(Buffer.from(await upstream.arrayBuffer()));
     } catch {
       res.status(502).end();
     }
   }
   
   app.get("/a/script", (req, res) =>
     relay(req, res, "https://metricraven.com/js/script.js", "public, max-age=3600"),
   );
   // The tracker sends JSON as text/plain; keep the raw body untouched.
   app.post("/a/event", express.raw({ type: () => true, limit: "64kb" }), (req, res) =>
     relay(req, res, "https://metricraven.com/api/v1/collect", "no-store"),
   );
   
   // Mount these routes in your existing app, or run this file on its own:
   app.listen(process.env.PORT || 3000);

2. Set trust proxy if you're behind a load balancer

   req.ip is the visitor only when Express knows which proxies to trust. On Heroku, Render, Railway or behind Nginx, uncomment app.set("trust proxy", 1) (one hop).

3. Point your script tag at your own paths

   Replace your MetricRaven tag with this one. src loads the tracker from your domain and data-api sends its events there too.

   Your website's shared layout

   Copy

   1

   <script defer src="/a/script" data-api="/a/event" data-site-id="YOUR_SITE_ID"></script>

Notes

• If a CDN or load balancer sits in front of this server, the connecting address is that proxy, not the visitor. Use the visitor IP header it sets (and only one it overwrites, so visitors can't fake it).
• The event route uses express.raw() so the body is relayed byte for byte. A global express.json() doesn't touch it, because the tracker sends text/plain.

How the proxy works and which headers it must send: Use your own domain.