mix dca83e9671 security: parse X-Forwarded-For from trusted proxies for rate-limit key ...

Resolves plan item A.1 (option б): login/setup rate-limiting used
RemoteAddr only, which behind the default reverse proxy is the proxy's own
address, making the limiter effectively global and enabling a lockout-DoS.
Now, when the request's direct peer matches the new TRUSTED_PROXY_CIDR list
(comma-separated CIDRs, env, empty by default), the last X-Forwarded-For
entry is used instead, giving a real per-client limit. Unset behaviour is
unchanged.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-15 23:53:59 +03:00

..

static

Phase 2: SQLite persistence, admin setup-link, login/sessions

2026-07-11 21:24:09 +03:00

templates

Phase 9: full backup/restore + domain export/import (spec 7.5, 11.6)

2026-07-14 22:33:07 +03:00

handlers_apps.go

Phase 9: full backup/restore + domain export/import (spec 7.5, 11.6)

2026-07-14 22:33:07 +03:00

handlers_auth.go

security: parse X-Forwarded-For from trusted proxies for rate-limit key

2026-07-15 23:53:59 +03:00

handlers_backup.go

Phase 9: full backup/restore + domain export/import (spec 7.5, 11.6)

2026-07-14 22:33:07 +03:00

handlers_domains.go

Phase 9: full backup/restore + domain export/import (spec 7.5, 11.6)

2026-07-14 22:33:07 +03:00

handlers_monitor.go

Phase 7: monitoring UI — send log, queue, mail.log tail

2026-07-13 23:22:08 +03:00

handlers_ratelimit.go

Phase 8: level-2 differentiated rate limits (spec 7.4)

2026-07-14 21:57:38 +03:00

handlers_setup.go

security: parse X-Forwarded-For from trusted proxies for rate-limit key

2026-07-15 23:53:59 +03:00

middleware.go

Phase 3: sending domains + per-domain OpenDKIM signing

2026-07-11 22:20:35 +03:00

ratelimit.go

Phase 2: SQLite persistence, admin setup-link, login/sessions

2026-07-11 21:24:09 +03:00

session.go

Phase 2: SQLite persistence, admin setup-link, login/sessions

2026-07-11 21:24:09 +03:00

setup.go

Phase 2: SQLite persistence, admin setup-link, login/sessions

2026-07-11 21:24:09 +03:00

templates.go

Phase 7: monitoring UI — send log, queue, mail.log tail

2026-07-13 23:22:08 +03:00

token.go

Phase 2: SQLite persistence, admin setup-link, login/sessions

2026-07-11 21:24:09 +03:00

validate_test.go

Phase 3: sending domains + per-domain OpenDKIM signing

2026-07-11 22:20:35 +03:00

validate.go

Phase 3: sending domains + per-domain OpenDKIM signing

2026-07-11 22:20:35 +03:00

web.go

security: parse X-Forwarded-For from trusted proxies for rate-limit key

2026-07-15 23:53:59 +03:00