Fix attempt 1 for the owner follow-up on #280 (owner: PALETTE_TRUSTED_IP_HEADER can be removed).
- Removes the env var, its plumbing (Config.TrustedIPHeader, SetTrustedIPHeader), and the README row.
- Rate-limit keying is always the peer address; no client-supplied IP header is ever trusted (tests assert CF-Connecting-IP/XFF/X-Real-Ip are ignored).
- Rotating-XFF bucket test retained.
go build/test green on the head.
Ref #280
Per owner decision the optional proxy-header escape hatch is dead config:
remove the env var, its plumbing (Config.TrustedIPHeader, SetTrustedIPHeader),
and the README row. Rate-limit keying is always the peer address; no
client-supplied IP header is ever trusted. Tests updated to assert headers
(CF-Connecting-IP included) never influence clientIP.
Closing as superseded: PR #291 (fix-280-r2) covers the same owner delta (remove PALETTE_TRUSTED_IP_HEADER, key on peer address only) and is the QA target.
Closing as superseded: PR #291 (fix-280-r2) covers the same owner delta (remove PALETTE_TRUSTED_IP_HEADER, key on peer address only) and is the QA target.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fix attempt 1 for the owner follow-up on #280 (owner: PALETTE_TRUSTED_IP_HEADER can be removed).
go build/test green on the head.
Ref #280
Closing as superseded: PR #291 (fix-280-r2) covers the same owner delta (remove PALETTE_TRUSTED_IP_HEADER, key on peer address only) and is the QA target.
Pull request closed