#280: remove PALETTE_TRUSTED_IP_HEADER, rate limits key on peer address only #291

Merged
fen merged 1 commits from fix-280-r2 into dev 2026-09-18 01:53:24 +00:00
Collaborator

Ref #280 (fix attempt 2, owner-delta). Owner comment: PALETTE_TRUSTED_IP_HEADER can be removed.

  • clientIP() keys on the peer address (RemoteAddr) only; no client-supplied header is ever trusted
  • Config.TrustedIPHeader, SetTrustedIPHeader and the README env row removed
  • TestClientIPNeverTrustsHeaders proves CF-Connecting-IP is ignored; rotating-XFF bucket test retained
Ref #280 (fix attempt 2, owner-delta). Owner comment: PALETTE_TRUSTED_IP_HEADER can be removed. - clientIP() keys on the peer address (RemoteAddr) only; no client-supplied header is ever trusted - Config.TrustedIPHeader, SetTrustedIPHeader and the README env row removed - TestClientIPNeverTrustsHeaders proves CF-Connecting-IP is ignored; rotating-XFF bucket test retained
fen added 1 commit 2026-09-18 01:49:04 +00:00
#280: remove PALETTE_TRUSTED_IP_HEADER, key rate limits on peer address only
CI / docker (pull_request) Skipped
CI / test (pull_request) Successful in 31s
aac1725c25
Owner follow-up to the #280 fix (PR #284): the trusted-header env var is
gone. clientIP() now uses the peer address exclusively and ignores all
client-supplied IP headers; the env var row is removed from the README.
fen merged commit aa72b4b38b into dev 2026-09-18 01:53:24 +00:00
Sign in to join this conversation.