Ref #280 (fix attempt 2, owner-delta). Owner comment: PALETTE_TRUSTED_IP_HEADER can be removed.
clientIP() keys on the peer address (RemoteAddr) only; no client-supplied header is ever trusted
Config.TrustedIPHeader, SetTrustedIPHeader and the README env row removed
TestClientIPNeverTrustsHeaders proves CF-Connecting-IP is ignored; rotating-XFF bucket test retained
Ref #280 (fix attempt 2, owner-delta). Owner comment: PALETTE_TRUSTED_IP_HEADER can be removed.
- clientIP() keys on the peer address (RemoteAddr) only; no client-supplied header is ever trusted
- Config.TrustedIPHeader, SetTrustedIPHeader and the README env row removed
- TestClientIPNeverTrustsHeaders proves CF-Connecting-IP is ignored; rotating-XFF bucket test retained
Owner follow-up to the #280 fix (PR #284): the trusted-header env var is
gone. clientIP() now uses the peer address exclusively and ignores all
client-supplied IP headers; the env var row is removed from the README.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Ref #280 (fix attempt 2, owner-delta). Owner comment: PALETTE_TRUSTED_IP_HEADER can be removed.