From 30af2b84adfb10159de1e31178620385613b0d9d Mon Sep 17 00:00:00 2001 From: NikolajDanger Date: Wed, 29 Jul 2026 16:49:15 +0200 Subject: [PATCH] :goat: comments --- backend/core/dependencies.py | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/backend/core/dependencies.py b/backend/core/dependencies.py index bd81784..80a6697 100644 --- a/backend/core/dependencies.py +++ b/backend/core/dependencies.py @@ -39,11 +39,13 @@ def get_client_ip(conn: Request | WebSocket) -> str: NPM sets X-Forwarded-For to $proxy_add_x_forwarded_for, which *appends* the peer it saw to whatever the client sent. So the last entry is always written by NPM and - anything a client forges lands to its left — take the rightmost, never the first. + anything a client forges lands to its left. Take the rightmost, never the first. - This trusts the header because NPM is the only way in: port 8000 is unpublished and - the backend only shares the `proxy` network with NPM. If a port is ever published, - or another container is put on `proxy`, this becomes forgeable and needs revisiting. + This trusts the header because port 8000 is not published: the only things that can + reach it are containers sharing a network with this one: NPM and the frontend on + `proxy`, and the database on `tcg-internal`. All three are trusted by topology. If a + port is ever published, or an untrusted container joins either network, the header + becomes forgeable and this needs revisiting. """ forwarded = conn.headers.get("x-forwarded-for") if forwarded: