sneak/webhooker
1
0
Fork 0
Code Issues 92 Pull Requests 10 Actions 31 Packages Projects Releases Wiki Activity

Trust the RFC 1918 ranges as proxies when TRUSTED_PROXIES is unset (closes #333)
check / check (push) Waiting to run
Details

Browse Source 
Unset or empty, TRUSTED_PROXIES now defaults to 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, so a reverse proxy reaching webhooker from one of those ranges gets per-client rate-limit buckets with nothing set. A set value replaces the default entirely; an unparseable one still fails startup. The startup warning for an empty list is gone.

The README gives the default, one rule (if any client can reach webhooker, or the proxy in front of it, from an RFC 1918 source address, set the list to the proxy's address alone), and where to find that address: the remoteIP field of the http request log line. Loopback is not in the default.

Model: opus-5-5
This commit was merged in pull request #336.
This commit is contained in:
clawbot
2026-10-02 00:41:36 +02:00
parent 30e65dce53
commit 515c359e56
10 changed files with 142 additions and 286 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/middleware/ratelimit.go
+2 -3
View File
@@ -123,9 +123,8 @@ func bucketKey(addr netip.Addr) string {
return prefix.String()
}
// isTrustedProxy reports whether addr belongs to a network the
// operator listed in TRUSTED_PROXIES. The list is empty by default,
// so by default nothing is trusted.
// isTrustedProxy reports whether addr belongs to a network in
// TRUSTED_PROXIES, which by default is the RFC 1918 private ranges.
func (m *Middleware) isTrustedProxy(addr netip.Addr) bool {
for _, prefix := range m.params.Config.TrustedProxies {
if prefix.Contains(addr) {