safe-global / safe-client-gateway / 27757722826 / 1

88%

main: 88%

push

github

fix: resolve req.ip from X-Forwarded-For via trust proxy (#3170)

Configure Express `trust proxy` so req.ip reflects the originating
client rather than the nearest upstream hop. The rate-limit, captcha
and blocklist guards rely on req.ip, so this gives them the correct
client address. Replace the getClientIp helper with req.ip.

Configurable via EXPRESS_TRUST_PROXY (default `loopback, uniquelocal`).

3296 of 5734 branches covered (57.48%)

Branch coverage included in aggregate %.

29637 of 36561 relevant lines covered (81.06%)

252.38 hits per line