clawbot 2532da55e9 Client address is the right-most untrusted X-Forwarded-For entry (closes #144) ...

From a peer in TRUSTED_PROXIES, clientIP took the left-most
X-Forwarded-For entry, which the client writes itself behind a proxy
that appends to the header, so a client could choose the address the
rate limit counts. It now walks the entries from the right past trusted
proxies and takes the first that is not one. An entry with a port is
read as its address; with only trusted entries, or one that is not an
address at all, it uses the peer. Every X-Forwarded-For header line is
read, and X-Real-IP only when there is no X-Forwarded-For entry.

Model: opus-5-5

2026-10-19 00:28:18 +02:00

..

config

Unset TRUSTED_PROXIES trusts RFC 1918, empty trusts none (closes #129)

2026-10-14 14:01:37 +02:00

globals

Move to the layout REPO_POLICIES.md gives (closes #30)

2026-10-14 12:01:32 +02:00

handlers

Reports refused while report files cannot be written (closes #123)

2026-10-14 13:47:14 +02:00

healthcheck

Move to the layout REPO_POLICIES.md gives (closes #30)

2026-10-14 12:01:32 +02:00

logger

Move to the layout REPO_POLICIES.md gives (closes #30)

2026-10-14 12:01:32 +02:00

middleware

Client address is the right-most untrusted X-Forwarded-For entry (closes #144)

2026-10-19 00:28:18 +02:00

reportbuf

Stopping the server waits for report file writes under way (closes #122)

2026-10-14 14:47:01 +02:00

server

A handler's panic is logged and counted as 500 (closes #125)

2026-10-14 13:30:11 +02:00