Ilker ManapandClaude Opus 5.5 fe5b7f88f0 Believe X-Forwarded-* only from router.trusted_proxies ...

A new internal/clientip says who sent a request and how: the connection's
address, scheme and Host, or through a configured proxy what it forwarded.
The base URL in pages and setup scripts, isHTTPS for cookies, and the
per-address limits of auth and the sign-in forms use it. /setup scripts are
no-store.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-04 10:29:02 +02:00

..

clientip_test.go

Believe X-Forwarded-* only from router.trusted_proxies

2026-10-04 10:29:02 +02:00

clientip.go

Believe X-Forwarded-* only from router.trusted_proxies

2026-10-04 10:29:02 +02:00