amadan
Cite the edge's X-Forwarded-For contract instead of paraphrasing it
clientIP takes the last element of X-Forwarded-For. The comment said the edge "strips inbound headers so the last element is the edge's own view of the client", which was roughly right and not checkable. Checked at source, in carlos/platform at 97eb53f. The contract is stronger and more specific than the paraphrase: inbound Forwarded and X-Forwarded-* are deleted outright, so a client cannot forge the header at all; SetXForwarded writes a single address; and on a verified edge-to-edge hop the chain is restored VERBATIM rather than appended to, with setForwarded stating the reason in as many words — "the last element has to stay the client" — and citing the platform's own consumer, internal/console/authcli.go's clientIP: "the LAST element is the one to take". The reason it is verbatim is the same one this function exists for: appending would rate-limit every backhauled request as one bucket per region.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
1 file changed,
+18
−4
internal/home/signin.go+18 −4
diff --git a/internal/home/signin.go b/internal/home/signin.go| index 0a5c33a..abbc298 100644 |
| --- a/internal/home/signin.go |
| +++ b/internal/home/signin.go |
| @@ -88,10 +88,24 @@ func newFlow(secrets Secrets, links signin.LinkStore) *signin.Flow { |
| // quarter of an hour, and §2.1 already names this service the suite's |
| // single point of failure. |
| // |
| -// The carlos edge sets X-Forwarded-For on every proxied request and |
| -// strips inbound Forwarded/X-Forwarded-* on unverified hops, so the last |
| -// element is the edge's own view of the client and a client cannot forge |
| -// it. Falling back to RemoteAddr covers a direct local connection. |
| +// Taking the LAST element is the carlos edge's documented contract, not |
| +// a guess. Verified in carlos/platform at 97eb53f: |
| +// |
| +// - stripForwardedHeaders deletes inbound Forwarded and |
| +// X-Forwarded-*, and ReverseProxy's Rewrite deletes them from the |
| +// outbound request before Rewrite runs, so a client cannot forge |
| +// this header at all. |
| +// - SetXForwarded then writes a single address: the peer that dialled. |
| +// - On a verified edge-to-edge hop the inbound chain is restored |
| +// VERBATIM rather than appended to, and setForwarded says why in as |
| +// many words: "the last element has to stay the client." It cites |
| +// the platform's own consumer, internal/console/authcli.go's |
| +// clientIP — "the LAST element is the one to take". |
| +// |
| +// Appending would have rate-limited every backhauled request as one |
| +// bucket per region, which is the same collapse this function exists to |
| +// avoid, one layer up. Falling back to RemoteAddr covers a direct local |
| +// connection. |
| // |
| // Returning "" is deliberate where no IP is knowable: no per-IP budget |
| // is strictly better than one global budget shared by everyone, and the |