agatha 9021f4816a Fix: Prefer X-Real-IP over XFF[0] in get_client_ip to close spoof bypass ...

XFF[0] is attacker-controllable; a crafted X-Forwarded-For header could
attribute login failures to a victim IP, triggering their lockout while
the attacker accumulates none. ingress-nginx sets X-Real-IP via its
realip module using an authoritative CIDR allowlist and overwrites any
client-supplied value, making it spoof-resistant. Fallback to XFF[0]
is retained for defence in depth but now emits a warning if reached.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-09 17:52:05 +00:00

..

__init__.py

[Spec Kit] Implementation progress

2026-05-02 16:13:23 +00:00

jwt_provider.py

Feat: Implement JWT bearer token authentication

2026-05-03 19:12:38 +00:00

noop.py

Feat: Implement JWT bearer token authentication

2026-05-03 19:12:38 +00:00

provider.py

Feat: Implement JWT bearer token authentication

2026-05-03 19:12:38 +00:00

rate_limiter.py

Fix: Prefer X-Real-IP over XFF[0] in get_client_ip to close spoof bypass

2026-05-09 17:52:05 +00:00