levaliciousandClaude Opus 5.5
5d6b0719b3
images / images (push) Successful in 7m29s
The proxy sets Forwarded, X-Forwarded-For/-Host/-Proto and X-Real-IP from the connection, but applied a route's request header filters after that, so whoever could write a route to a backend could tell it any client address (a backend that trusts the gateway's X-Forwarded-For believes it). An HTTPRoute whose request header filter sets, adds or removes one of them (names compared case-insensitively) is now not accepted (UnsupportedValue), like the other filters we do not serve. The proxy also sets them after the filters, clearing them first: SetXForwarded appends to an X-Forwarded-For already there. The proxy test's backend now prints every X-Forwarded-For value; it printed only the first, which hid an appended one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UHXzGrsxfkGk8LmwrBbHNZ