poslop/palette
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Fix #280 follow-up: remove PALETTE_TRUSTED_IP_HEADER
CI / test (pull_request) Successful in 26s
Details
CI / docker (pull_request) Skipped
Details

Browse Source 
Per owner decision the optional proxy-header escape hatch is dead config:
remove the env var, its plumbing (Config.TrustedIPHeader, SetTrustedIPHeader),
and the README row. Rate-limit keying is always the peer address; no
client-supplied IP header is ever trusted. Tests updated to assert headers
(CF-Connecting-IP included) never influence clientIP.
This commit is contained in:
fen
2026-09-17 20:45:54 -05:00
parent ed435c5e13
commit b99e1bdb27
4 changed files with 18 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/api/ratelimit_xff_test.go
+15 -17
View File
@@ -7,8 +7,6 @@ import (
)
func TestClientIPUsesRemoteAddrNotXFF(t *testing.T) {
SetTrustedIPHeader("")
defer SetTrustedIPHeader("")
r := httptest.NewRequest("POST", "/api/pastes", nil)
r.RemoteAddr = "203.0.113.7:4432"
r.Header.Set("X-Forwarded-For", "1.2.3.4, 1.2.3.5, 203.0.113.9")
@@ -18,18 +16,20 @@ func TestClientIPUsesRemoteAddrNotXFF(t *testing.T) {
}
}
func TestClientIPTrustedHeaderOnlyWhenConfigured(t *testing.T) {
SetTrustedIPHeader("")
defer SetTrustedIPHeader("")
r := httptest.NewRequest("POST", "/api/pastes", nil)
r.RemoteAddr = "10.0.1.47:9999"
r.Header.Set("CF-Connecting-IP", "198.51.100.9")
if got := clientIP(r); got != "10.0.1.47" {
t.Fatalf("unconfigured: clientIP = %q, want peer 10.0.1.47", got)
}
SetTrustedIPHeader("CF-Connecting-IP")
if got := clientIP(r); got != "198.51.100.9" {
t.Fatalf("configured: clientIP = %q, want CF-Connecting-IP value", got)
// No client-controlled IP header is ever honored, including proxy-typical
// ones when set by an attacker.
func TestClientIPNeverTrustsHeaders(t *testing.T) {
for _, h := range []struct{ name, val string }{
{"CF-Connecting-IP", "198.51.100.9"},
{"X-Forwarded-For", "198.51.100.1"},
{"X-Real-Ip", "198.51.100.2"},
} {
r := httptest.NewRequest("POST", "/api/pastes", nil)
r.RemoteAddr = "10.0.1.47:9999"
r.Header.Set(h.name, h.val)
if got := clientIP(r); got != "10.0.1.47" {
t.Fatalf("%s header: clientIP = %q, want peer 10.0.1.47", h.name, got)
}
}
}
@@ -37,9 +37,7 @@ func TestClientIPTrustedHeaderOnlyWhenConfigured(t *testing.T) {
// repro was 8 creates with rotating XFF -> 6x201.
func TestRotatingXFFDoesNotResetBucket(t *testing.T) {
globalLimiter = newLimiter()
defer SetTrustedIPHeader("")
SetTrustedIPHeader("")
s := defaultSettings(Config{}) // burst/limit defaults; any header values are ignored anyway
s := defaultSettings(Config{})
var allowed, limited int
for i := 0; i < 8; i++ {
r := httptest.NewRequest("POST", "/api/pastes", nil)