J3vbandClaude Fable 5 a762dc712d fix(api): keep per-client keys distinct under broad trusted_proxies (W2-5) ...

With trusted_proxies covering client networks (e.g. 10.0.0.0/8 over LAN
clients), the right-to-left XFF walk skipped every entry, exhausted, and
fell back to the proxy's RemoteAddr — collapsing all clients into one
rate-limit/lockout bucket, so one user's failed logins locked out
everyone. On exhaustion the walk now returns the leftmost valid entry
(furthest-upstream hop), the best distinct per-client key such a config
allows. An untrusted RemoteAddr still never gets its headers honoured.

Also (W3-3): the CIDR list parses once per request instead of once per
XFF candidate, config load warns about invalid CIDR entries at startup
(a silently skipped entry silently un-trusts the proxy), and the sample
config documents that trusted_proxies must list only proxy hops.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-19 08:56:34 +02:00

..

config_test.go

test: boost server coverage — auth 60→95%, db 69→81%, config 75→85%

2026-04-01 11:38:11 +02:00

config.go

fix(api): keep per-client keys distinct under broad trusted_proxies (W2-5)

2026-07-19 08:56:34 +02:00

constants.go

fix: resolve 20 code review bugs across Rust, TypeScript, and Go

2026-04-03 23:18:06 +02:00

main_test.go

feat: add syncutil mutex, test scaffolding, and server hardening

2026-04-01 12:04:15 +02:00