umputun / remark42 / 28722374138

85%

master: 84%

Pull #2116

github

fix: add --trusted-proxy to gate client-IP forwarding headers

Rate limiting and (with --votes-ip) vote de-duplication key on the client IP,
recovered from forwarding headers (X-Real-IP / X-Forwarded-For / CF-Connecting-IP)
when behind a reverse proxy. Those headers were accepted from any client, so a
caller could set them to change its apparent IP.

Add --trusted-proxy / TRUSTED_PROXY (comma-separated CIDR/IP): forwarding headers
are honored only when the direct peer is a trusted proxy; other peers keep their
real socket address. Unset preserves the previous trust-all behavior (with a
startup warning) so existing deployments keep working on upgrade.

Docs: a 'Trusted proxies and client IP' section with per-topology guidance, plus a
note in the nginx manual.

64 of 66 new or added lines in 3 files covered. (96.97%)

6471 of 7655 relevant lines covered (84.53%)

36.69 hits per line