The client address came from the left-most X-Forwarded-For or Forwarded
entry, which the client writes itself, so a banned or rate-limited client
behind a proxy could pick any address. Headers are now read only when the
connection comes from a trusted proxy, and the client is the right-most
hop no trusted proxy accounts for.
Trusted by default: loopback and the private ranges. INBUXA_HTTP_TRUSTED_PROXIES
replaces that list. A direct client's headers are ignored, and scanner bans
apply to it even with forwarding on.
jcoffey-dev
1954198fe8