3 Commits

Include renames

Author	SHA1	Message	Date
fen	aac1725c25	#280: remove PALETTE_TRUSTED_IP_HEADER, key rate limits on peer address only ... Owner follow-up to the #280 fix (PR #284): the trusted-header env var is gone. clientIP() now uses the peer address exclusively and ignores all client-supplied IP headers; the env var row is removed from the README.	2026-09-17 20:48:52 -05:00
fen	f63efc6d88	Fix rate limiter bypass via client-controlled X-Forwarded-For (#280) ... clientIP() keyed rate-limit buckets on the rightmost X-Forwarded-For entry, assuming traefik appends the real client IP. The deployed ingress does not rewrite XFF, so rotating the header gave a fresh bucket per request (pentest H1: 8 creates with rotating XFF -> 6x201). Now the bucket keys on the actual peer address (RemoteAddr) by default; every client-supplied IP header is ignored. Deployments whose ingress overwrites a client-IP header can opt in via PALETTE_TRUSTED_IP_HEADER (e.g. CF-Connecting-IP behind Cloudflare) to restore per-client limits. Adds tests: rotating XFF no longer resets the bucket; the trusted header is honored only when explicitly configured.	2026-09-17 20:29:40 -05:00
agent	3d1d5ee1fd	ratelimit: key on rightmost X-Forwarded-For entry (fixes #85)	2026-09-09 10:57:59 -05:00