safe-global / safe-client-gateway / 27615530752

90%

main: 90%

Pull #3170

github

fix: resolve req.ip from X-Forwarded-For via trust proxy

Configure Express `trust proxy` so req.ip reflects the originating
client rather than the nearest upstream hop. The rate-limit, captcha
and blocklist guards rely on req.ip, so this gives them the correct
client address. Replace the getClientIp helper with req.ip.

Configurable via EXPRESS_TRUST_PROXY (default `loopback, uniquelocal`).

4622 of 5495 branches covered (84.11%)

Branch coverage included in aggregate %.

6 of 6 new or added lines in 2 files covered. (100.0%)

17104 of 18564 relevant lines covered (92.14%)

595.57 hits per line