sneak d1ccea78fb Client address is the right-most untrusted X-Forwarded-For entry (closes #144) ...

From a peer in TRUSTED_PROXIES, clientIP took the left-most
X-Forwarded-For entry, which the client writes itself behind a proxy
that appends to the header, so a client could choose the address the
rate limit counts and the request log records. It now walks the entries
from the right past trusted proxies and takes the first that is not
one; with only trusted entries, or one that is not an address, it uses
the peer. Every X-Forwarded-For header line is read. X-Real-IP is read
only when there is no X-Forwarded-For entry. README.md Settings says
which entry is taken.

Model: opus-5-5

2026-10-18 21:05:54 +00:00

..

export_test.go

Move to the layout REPO_POLICIES.md gives (closes #30)

2026-10-14 12:01:32 +02:00

middleware_test.go

Client address is the right-most untrusted X-Forwarded-For entry (closes #144)

2026-10-18 21:05:54 +00:00

middleware.go

Client address is the right-most untrusted X-Forwarded-For entry (closes #144)

2026-10-18 21:05:54 +00:00