ServerKit

admin/ServerKit

0 Fork 0

mirror of https://github.com/jhd3197/ServerKit.git synced 2026-10-30 16:47:01 +09:00

Files

T

History

Juan DenisandClaude Opus 4.8 363a09dc7e feat(security): trust reverse-proxy client IP via one gated seam

Rate-limit buckets, login lockout and audit-log source IPs hand-parsed the
leftmost X-Forwarded-For token — a client-controlled value — letting an
attacker rotate it to dodge per-IP limits or forge audit trails.

- config: add TRUST_PROXY_HEADERS / TRUSTED_PROXY_HOPS (+ _env_bool/_env_int)
- create_app: wrap in gated Werkzeug ProxyFix (rightmost trusted hops) before
  the limiter/handlers so every remote_addr consumer sees the real client
- new app/utils/client_ip.py::get_client_ip() — the single trusted seam
- replace all six leftmost-XFF parsers (rate_limit, audit middleware,
  api_key_auth, api_analytics, audit_service, ddns) with get_client_ip()
- deploy: root .env.example ships TRUST_PROXY_HEADERS=true (behind nginx);
  backend/.env.example documents it off for dev
- tests: test_trusted_client_ip.py (7) incl. real flask-limiter bucket isolation

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-18 00:51:21 -04:00

__init__.py

Implement security features: key rotation, IP allowlist, anomaly detection

2026-01-22 18:11:22 -05:00

backup_crypto.py

feat(backups): client-side encryption (opt-in, reuses the Fernet key)

2026-06-19 13:22:43 -04:00

client_ip.py

feat(security): trust reverse-proxy client IP via one gated seam

2026-07-18 00:51:21 -04:00

crypto.py

fix(system): version resolution honors custom install dirs and Docker