sneak a594fb04f6 Client address is the right-most untrusted X-Forwarded-For entry (closes #144) ...

From a peer in TRUSTED_PROXIES, clientIP took the left-most
X-Forwarded-For entry, which the client writes itself behind a proxy
that appends to the header, so a client could choose the address the
rate limit counts and the request log records. It now walks the entries
from the right past trusted proxies and takes the first that is not
one. An entry written as an address with a port is read as that
address; with only trusted entries, or one that is not an address at
all, it uses the peer. Every X-Forwarded-For header line is read.
X-Real-IP is read only when there is no X-Forwarded-For entry.
README.md Settings says which entry is taken.

Model: opus-5-5

2026-10-18 21:33:58 +00:00

..

export_test.go

Move to the layout REPO_POLICIES.md gives (closes #30)

2026-10-14 12:01:32 +02:00

middleware_test.go

Client address is the right-most untrusted X-Forwarded-For entry (closes #144)

2026-10-18 21:33:58 +00:00

middleware.go

Client address is the right-most untrusted X-Forwarded-For entry (closes #144)

2026-10-18 21:33:58 +00:00