clawbot 194c0ded63 Count an IPv4-mapped login client by its IPv4 address (closes #66) ...

A proxy on a dual-stack listener forwards an IPv4 client as ::ffff:a.b.c.d,
whose /64 is the same for every IPv4 client, so one client's failed logins
refused everyone's. The rate limit key now unmaps the address first.

README.md now says that with the default trusted_proxies a client with a
private address can choose its counted address through X-Forwarded-For, and
that setting trusted_proxies to the proxy's own address closes this.

Model: opus-5-5

2026-09-28 22:49:07 +00:00

..

client_ip_internal_test.go

Resolve real client IP behind trusted proxies (closes #94)

2026-09-22 10:25:41 +02:00

middleware_internal_test.go

feat: add HSTS, CSP, and Permissions-Policy security headers (closes #91)

2026-09-21 20:43:13 +02:00

middleware.go

Count an IPv4-mapped login client by its IPv4 address (closes #66)

2026-09-28 22:49:07 +00:00