mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
J3vbandClaude Fable 5
a762dc712d
With trusted_proxies covering client networks (e.g. 10.0.0.0/8 over LAN clients), the right-to-left XFF walk skipped every entry, exhausted, and fell back to the proxy's RemoteAddr — collapsing all clients into one rate-limit/lockout bucket, so one user's failed logins locked out everyone. On exhaustion the walk now returns the leftmost valid entry (furthest-upstream hop), the best distinct per-client key such a config allows. An untrusted RemoteAddr still never gets its headers honoured. Also (W3-3): the CIDR list parses once per request instead of once per XFF candidate, config load warns about invalid CIDR entries at startup (a silently skipped entry silently un-trusts the proxy), and the sample config documents that trusted_proxies must list only proxy hops. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>