SECURITY: realIP trusts X-Forwarded-For/X-Real-IP headers unconditionally #44

New Issue

2026-02-16T06:56:37+01:00

clawbot commented

2026-02-16 06:56:37 +01:00

Severity: MEDIUM

File: `internal/middleware/middleware.go` lines ~105-125 (realIP function)

Description

The realIP function trusts X-Real-IP and X-Forwarded-For headers from any client, not just trusted reverse proxies. This is used for:

Request logging (informational)
Rate limiting (security-critical)

An attacker can bypass the login rate limiter by sending a spoofed X-Forwarded-For header with a different IP on each request, getting unlimited login attempts.

Suggested Fix

Add a configuration option for trusted proxy CIDRs
Only trust forwarded headers when the direct connection comes from a trusted proxy
Fall back to RemoteAddr for untrusted connections

Alternatively, use chi's built-in middleware.RealIP which can be configured with trusted proxies, or always rate-limit on RemoteAddr in addition to the extracted IP.

## Severity: MEDIUM ## File: `internal/middleware/middleware.go` lines ~105-125 (realIP function) ## Description The `realIP` function trusts `X-Real-IP` and `X-Forwarded-For` headers from any client, not just trusted reverse proxies. This is used for: 1. Request logging (informational) 2. **Rate limiting** (security-critical) An attacker can bypass the login rate limiter by sending a spoofed `X-Forwarded-For` header with a different IP on each request, getting unlimited login attempts. ## Suggested Fix 1. Add a configuration option for trusted proxy CIDRs 2. Only trust forwarded headers when the direct connection comes from a trusted proxy 3. Fall back to `RemoteAddr` for untrusted connections Alternatively, use chi's built-in `middleware.RealIP` which can be configured with trusted proxies, or always rate-limit on `RemoteAddr` in addition to the extracted IP.

sneak commented

2026-02-16 06:59:53 +01:00

assume any request from an RFC1918 IP is a trusted proxy. if the request has an x-real-ip or x-forwarded-for and isn't coming from an rfc1918 ip, fail closed.

clawbot referenced a pull request that will close this issue

2026-02-16 07:02:14 +01:00

fix: only trust proxy headers from RFC1918/loopback sources (closes #44) #47

sneak closed this issue

2026-02-16 07:03:23 +01:00

sneak referenced this issue from a commit

2026-02-16 07:03:24 +01:00

fix: only trust proxy headers from RFC1918/loopback sources (closes #44)

sneak referenced this issue from a commit

2026-02-16 07:03:24 +01:00

Merge pull request 'fix: only trust proxy headers from RFC1918/loopback sources (closes #44)' (#47) from clawbot/upaas:fix/realip-trusted-proxy into main

Sign in to join this conversation.