safe-global / safe-client-gateway / 27616799800 / 1

90%

main: 90%

Pull #3170

github

fix: resolve req.ip from X-Forwarded-For via trust proxy

Configure Express `trust proxy` so req.ip reflects the originating
client rather than the nearest upstream hop. The rate-limit, captcha
and blocklist guards rely on req.ip, so this gives them the correct
client address. Replace the getClientIp helper with req.ip.

Configurable via EXPRESS_TRUST_PROXY (default `loopback, uniquelocal`).

3293 of 5732 branches covered (57.45%)

Branch coverage included in aggregate %.

29639 of 36559 relevant lines covered (81.07%)

235.48 hits per line