Relay: per-address limit counts all HTTPS users as one

littlefox commented

2026-10-18 14:29:45 +00:00

Owner

In the Docker image's HTTPS mode (#98), Caddy proxies /relay to 127.0.0.1:4895, so the relay sees every https client as 127.0.0.1. NEOKOM_RELAY_TRUST_PROXY isn't set (and setting it would be unsafe: port 4895 is also published directly, so any client could send a fake X-Forwarded-For). Result: NEOKOM_RELAY_PER_ADDRESS (8) is shared by all https users together.

Fix: honour X-Forwarded-For only when the TCP peer is the proxy (loopback by default, or a configured address), and turn that on in the image. Test: two clients over https get their own limits; a direct ws:// client with a forged X-Forwarded-For is counted by its own address.

In the Docker image's HTTPS mode (#98), Caddy proxies /relay to 127.0.0.1:4895, so the relay sees every https client as 127.0.0.1. NEOKOM_RELAY_TRUST_PROXY isn't set (and setting it would be unsafe: port 4895 is also published directly, so any client could send a fake X-Forwarded-For). Result: NEOKOM_RELAY_PER_ADDRESS (8) is shared by all https users together. Fix: honour X-Forwarded-For only when the TCP peer is the proxy (loopback by default, or a configured address), and turn that on in the image. Test: two clients over https get their own limits; a direct ws:// client with a forged X-Forwarded-For is counted by its own address.

littlefox added the

kind/bug

area/web

labels

2026-10-18 14:29:45 +00:00

littlefox referenced this issue from a pull request that will close it,

2026-10-18 14:43:23 +00:00

Relay: trust X-Forwarded-For only from the proxy itself #116

littlefox referenced this issue from a commit

2026-10-18 14:43:25 +00:00

Relay: trust X-Forwarded-For only from the proxy itself

littlefox closed this issue

2026-10-18 15:48:55 +00:00

littlefox commented

2026-10-18 15:52:02 +00:00

Author

Owner

Fixed in #116. Verified: unit and integration tests in kom-relay; tools/web-image-smoke.sh on a fresh image counts https clients by their own address and ignores a forged X-Forwarded-For (through Caddy and on 4895); the same check fails on the 0.2.0-era image git-d4d6827. Published as latest/git-b6292c5; the user's container runs it (healthy, trusted_proxies loopback).

Rows
Columns

Relay: per-address limit counts all HTTPS users as one #114