Honour forwarded headers only from trusted proxies (closes #259)

Before, the server took the client's address from X-Forwarded-For or X-Real-IP whoever sent them, so a direct client could get past the login rate limit and choose the address and hostname recorded for its session.

A new ClientIP middleware, run before request logging, resolves the address once: forwarded headers count only when the peer is in TRUSTED_PROXIES, which defaults to the RFC 1918 ranges. A set list replaces the default, the empty string trusts nothing, and an invalid entry stops startup. The request log, login rate limiter and session creation all use the resolved address.

A proxy on the same host as a server outside Docker connects from 127.0.0.1 or ::1, which the default does not trust; the README says to list it.

Model: opus-5-5

internal/handlers/api_test.go

@@ -4281,6 +4281,117 @@ func TestLoginRateLimitExceeded(t *testing.T) {
 	}
 }
 
+func TestLoginRateLimitIgnoresForwardedHeaders(t *testing.T) {
+	t.Parallel()
+
+	// The test client connects from 127.0.0.1, which is outside the
+	// default trusted proxies, so the server must ignore these headers.
+	tests := []struct {
+		name   string
+		header string
+	}{
+		{name: "X-Forwarded-For", header: "X-Forwarded-For"},
+		{name: "X-Real-IP", header: "X-Real-IP"},
+	}
+
+	loginBody, err := json.Marshal(map[string]string{
+		nickKey: "unknownnick", passwordKey: "wrongpassword",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			tserver := newTestServer(t)
+
+			// The default burst is 5 attempts, so the sixth gets 429
+			// although each claims a new address.
+			var status int
+
+			for attempt := range 6 {
+				request, rErr := http.NewRequestWithContext(
+					t.Context(), http.MethodPost,
+					tserver.url("/api/v1/login"),
+					bytes.NewReader(loginBody),
+				)
+				if rErr != nil {
+					t.Fatal(rErr)
+				}
+
+				request.Header.Set("Content-Type", "application/json")
+				request.Header.Set(
+					test.header, fmt.Sprintf("203.0.113.%d", attempt+1),
+				)
+
+				resp, dErr := http.DefaultClient.Do(request)
+				if dErr != nil {
+					t.Fatal(dErr)
+				}
+
+				status = resp.StatusCode
+				_ = resp.Body.Close()
+			}
+
+			if status != http.StatusTooManyRequests {
+				t.Fatalf("sixth attempt got %d, want 429", status)
+			}
+		})
+	}
+}
+
+func TestLoginRateLimitPerClientBehindTrustedProxy(t *testing.T) {
+	// The test client connects from 127.0.0.1. Trusted as a proxy, it
+	// passes each client's address in X-Forwarded-For. t.Setenv rules
+	// out t.Parallel.
+	t.Setenv("TRUSTED_PROXIES", "127.0.0.1")
+
+	tserver := newTestServer(t)
+
+	// An empty JSON object is refused after the rate limit counts the
+	// attempt, so no attempt checks a password or looks up a hostname.
+	loginFrom := func(forwardedFor string) int {
+		t.Helper()
+
+		request, err := http.NewRequestWithContext(
+			t.Context(), http.MethodPost,
+			tserver.url("/api/v1/login"), strings.NewReader("{}"),
+		)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		request.Header.Set("Content-Type", "application/json")
+		request.Header.Set("X-Forwarded-For", forwardedFor)
+
+		resp, err := http.DefaultClient.Do(request)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		_ = resp.Body.Close()
+
+		return resp.StatusCode
+	}
+
+	// The default burst is 5 attempts per address.
+	for range 5 {
+		loginFrom("203.0.113.1")
+	}
+
+	status := loginFrom("203.0.113.1")
+	if status != http.StatusTooManyRequests {
+		t.Errorf("sixth attempt from 203.0.113.1 got %d, want 429", status)
+	}
+
+	status = loginFrom("203.0.113.2")
+	if status == http.StatusTooManyRequests {
+		t.Error("first attempt from 203.0.113.2 got 429")
+	}
+}
+
 func TestLoginRateLimitAllowsNormalUse(t *testing.T) {
 	t.Parallel()