sneak
82265617da
check / check (push) Failing after 39s
realIP took the first X-Forwarded-For entry, which the client itself can write, so behind a proxy that appends to the header a client chose the address dnswatcher logs and the /metrics rate limit counts. It now walks the entries from the right past trusted proxies, using the existing trusted-proxy check, and takes the first that is not one; the leftmost when all are. All X-Forwarded-For header lines are read as one list, since a proxy may add its own line instead of appending to the client's. An empty entry where the client address belongs falls back to the peer address, as an empty first entry did before. X-Real-IP is unchanged. Model: opus-5-5
20 lines
418 B
Go
20 lines
418 B
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
"time"
|
|
)
|
|
|
|
// The /metrics rate limit, exported so the tests can count requests
|
|
// against it.
|
|
const (
|
|
MetricsRequestLimit = metricsRequestLimit
|
|
MetricsRequestWindow time.Duration = metricsRequestWindow
|
|
)
|
|
|
|
// RealIP is realIP, exported so the tests can check which address it
|
|
// takes as the client's.
|
|
func RealIP(r *http.Request) string {
|
|
return realIP(r)
|
|
}
|