sneak 20a18c7345 feat: use resolved client IP in request and auth logs ...

Add a ClientIP middleware that resolves the client address once per
request and stores it in the context, placed ahead of logging in the
route chain. The request-logging middleware and both login-attempt logs
now read the resolved address instead of the raw peer. Behind a trusted
proxy these records show the real client; a direct, untrusted client
still shows its own address and cannot forge one. Removes the local
host:port helper now that the clientip package owns that parsing.

Model: opus-4-8

2026-09-21 23:23:56 +00:00

..

http_internal_test.go

Harden http.Server: slowloris timeouts and form body limit (closes #92)

2026-09-21 20:59:24 +02:00

http.go

Harden http.Server: slowloris timeouts and form body limit (closes #92)

2026-09-21 20:59:24 +02:00

routes.go

feat: use resolved client IP in request and auth logs

2026-09-21 23:23:56 +00:00

server.go

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00