🐐 comments

backend/core/dependencies.py

@@ -39,11 +39,13 @@ def get_client_ip(conn: Request | WebSocket) -> str:
 
   NPM sets X-Forwarded-For to $proxy_add_x_forwarded_for, which *appends* the peer
   it saw to whatever the client sent. So the last entry is always written by NPM and
-  anything a client forges lands to its left — take the rightmost, never the first.
+  anything a client forges lands to its left. Take the rightmost, never the first.
 
-  This trusts the header because NPM is the only way in: port 8000 is unpublished and
-  the backend only shares the `proxy` network with NPM. If a port is ever published,
-  or another container is put on `proxy`, this becomes forgeable and needs revisiting.
+  This trusts the header because port 8000 is not published: the only things that can
+  reach it are containers sharing a network with this one: NPM and the frontend on
+  `proxy`, and the database on `tcg-internal`. All three are trusted by topology. If a
+  port is ever published, or an untrusted container joins either network, the header
+  becomes forgeable and this needs revisiting.
   """
   forwarded = conn.headers.get("x-forwarded-for")
   if forwarded: