Problem. internal/api/router/router.go:74 uses chi middleware.RealIP, which rewrites RemoteAddr from True-Client-IP, then X-Real-IP, then the leftmost X-Forwarded-For, from any client. chi 5.3.0 marks it deprecated for exactly this (GHSA-3fxj-6jh8-hvhx). Everything keyed on the client IP is spoofable: the chi access log, the WebSocket per-IP cap (internal/ws/handler.go:56-66), and any future rate limiter. Both edges now strip those headers and set X-Real-IP themselves (2026-09-02), but the server should not depend on that.
Ask.
- Replace
RealIP with a small middleware: use X-Real-IP only when RemoteAddr is inside a configured server.trusted_proxies CIDR list; otherwise use RemoteAddr as-is. Default empty.
- Document the key in
config.yaml.example (Docker deployments would list the compose network, a host-proxy deployment 127.0.0.1/8).
Problem.
internal/api/router/router.go:74uses chimiddleware.RealIP, which rewritesRemoteAddrfromTrue-Client-IP, thenX-Real-IP, then the leftmostX-Forwarded-For, from any client. chi 5.3.0 marks it deprecated for exactly this (GHSA-3fxj-6jh8-hvhx). Everything keyed on the client IP is spoofable: the chi access log, the WebSocket per-IP cap (internal/ws/handler.go:56-66), and any future rate limiter. Both edges now strip those headers and setX-Real-IPthemselves (2026-09-02), but the server should not depend on that.Ask.
RealIPwith a small middleware: useX-Real-IPonly whenRemoteAddris inside a configuredserver.trusted_proxiesCIDR list; otherwise useRemoteAddras-is. Default empty.config.yaml.example(Docker deployments would list the compose network, a host-proxy deployment127.0.0.1/8).