xarmian ec9edef68c fix(server): gate RealIP on PAD_TRUSTED_PROXIES (TASK-660) (#173) ...

Replace the unconditional chimiddleware.RealIP with a middleware that
only trusts X-Real-IP / X-Forwarded-For when the direct TCP peer is
within a configured CIDR. With the safe default (PAD_TRUSTED_PROXIES
unset) proxy headers are ignored entirely — the real TCP peer address
is used for rate limiting, the bootstrap loopback check, and audit logs.

Why: previously any client could set X-Forwarded-For to bypass per-IP
rate limits AND the bootstrap loopback check (handlers_auth.go). On a
direct-exposed Docker deploy (see M6, TASK-661) this compounded into a
full-takeover chain. Gating RealIP breaks that chain even when the
operator forgets to firewall the port.

- internal/server/middleware_realip.go — new TrustedProxyRealIP
  middleware + ParseTrustedProxyCIDRs helper (accepts CIDRs or bare IPs,
  invalid entries logged+skipped, empty = nil result = no-op middleware).
- internal/server/server.go — swap chimiddleware.RealIP for the gated
  version; add trustedProxyCIDRs field and SetTrustedProxies wiring.
- internal/config/config.go — TrustedProxies field + PAD_TRUSTED_PROXIES
  env var.
- cmd/pad/main.go — plumb config to the server.
- internal/server/middleware_realip_test.go — covers no-trust default,
  untrusted peer, trusted peer with X-Real-IP, X-Forwarded-For first
  entry, and invalid header.

Parent: PLAN-643 (OSS Security Hardening).

2026-04-21 19:03:49 -04:00

..

pad

fix(server): gate RealIP on PAD_TRUSTED_PROXIES (TASK-660) (#173)

2026-04-21 19:03:49 -04:00