sneak 2de0a79ffd Say the proxy is covered by default or by a set value ...

The rate-limit test comments on trustedProxyCIDR and forwardedKeyFor
said production needs TRUSTED_PROXIES set; another said only
operator-listed addresses are trusted. The README's Rate Limiting
paragraph said "listed in", and the login endpoint section assumed
every proxied deployment shares one bucket. All now match the
RFC 1918 default.

Model: opus-5-5

2026-10-01 18:47:25 +00:00

..

accesslog_test.go

Report handler panics through the logger and answer 500 (closes #187)

2026-08-18 08:33:12 +02:00

csrf_test.go

Default WEBHOOKER_ENVIRONMENT to prod (closes #307)

2026-09-28 12:47:31 +02:00

csrf.go

Derive cookie Secure and CSRF strictness from the request transport (closes #269)

2026-08-24 03:01:37 +02:00

export_test.go

Derive cookie Secure and CSRF strictness from the request transport (closes #269)

2026-08-24 03:01:37 +02:00

logbound_test.go

Bound every slog line against client-chosen text (closes #176)

2026-08-18 06:03:10 +02:00

loginguard_test.go

Stop a slow host turning a login-guard test into a segfault (closes #186)

2026-08-18 05:01:13 +02:00

loginguard.go

Trust the RFC 1918 ranges as proxies when TRUSTED_PROXIES is unset (closes #333)

2026-10-01 18:44:03 +00:00

metrics_method_test.go

Bound the /metrics method label (closes #261)

2026-08-24 02:03:18 +02:00

metrics_test.go

Bound the /metrics method label (closes #261)

2026-08-24 02:03:18 +02:00

metrics.go

Bound the /metrics method label (closes #261)

2026-08-24 02:03:18 +02:00

middleware_test.go

Bound every slog line against client-chosen text (closes #176)

2026-08-18 06:03:10 +02:00

middleware.go

Label HTTP metrics with the chi route pattern (closes #254)

2026-08-24 01:32:44 +02:00

ratelimit_test.go

Say the proxy is covered by default or by a set value

2026-10-01 18:47:25 +00:00

ratelimit.go

Trust the RFC 1918 ranges as proxies when TRUSTED_PROXIES is unset (closes #333)

2026-10-01 18:44:03 +00:00

recoverer_test.go

Drop Set-Cookie from the recovered 500 (closes #193)

2026-09-29 10:30:26 +02:00

recoverer.go

Drop Set-Cookie from the recovered 500 (closes #193)

2026-09-29 10:30:26 +02:00

testing.go

refactor: use pinned golangci-lint Docker image for linting (#55)

2026-03-25 02:16:38 +01:00