AutopilotMonitor

mirror of https://github.com/okieselbach/AutopilotMonitor.git synced 2026-10-25 05:00:07 +00:00

Files

T

Oliver Kieselbach 6cbd507b4f fix: client-IP extraction was dead on Flex — RemoteIpAddress fallback + AFD-aware rate-limit key

Post-deploy verification of the go endpoint showed every anonymous caller
keyed as "unknown": Flex Consumption does not surface X-Forwarded-For to
the isolated worker, so ALL per-IP rate-limit buckets (bootstrap-validate,
distress, diag-ticket-download, stats/platform) had silently collapsed
into one shared bucket — confirmed by DistressReports.SourceIp being
"unknown" across the board.

- GetTrustedClientIp falls back to HttpContext.Connection.RemoteIpAddress
  (transport-derived, unspoofable; IPv4-mapped addresses normalized).
  Heals every existing caller without signature changes.
- New GetRateLimitClientIp for AFD-fronted endpoints: honors
  X-Azure-ClientIP only when X-Azure-FDID carries exactly our profile ID
  (FrontDoorProfileId app setting, set on autopilotmonitor-api-eu);
  fail-closed to GetTrustedClientIp on unset/mismatch/multi-value.
  Used by GetBootstrapScriptFunction (traffic arrives via
  go.autopilotmonitor.com, where the trusted hop is AFD egress).
- FdidMatches table tests incl. append/spoof cases.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-29 00:01:31 +02:00

Certificates

chore(backend/security): drop legacy duplicate Intune CA PEMs

2026-05-08 15:59:41 +02:00

AutopilotDeviceValidator.cs

refactor(urls): one guard-enforced URL registry per component, agent downloads move to the alias

2026-07-23 08:37:42 +02:00

BootstrapScriptValueValidator.cs

feat: move OOBE bootstrap script endpoint into the backend (go.autopilotmonitor.com)

2026-07-28 21:42:56 +02:00

CertificateValidator.cs

chore(build): clear the compiler and xUnit analyzer warnings CI annotates