mirror of
https://github.com/yhirose/cpp-httplib.git
synced 2026-10-03 14:03:15 +07:00
yhirose
fd0c18b1b5
Server::process_request only checked that trusted_proxies_ was non-empty before deriving req.remote_addr from the X-Forwarded-For header. It never verified that the actual TCP peer (remote_addr) was itself one of the trusted proxies, so any client connecting directly to the server could spoof remote_addr simply by sending an arbitrary X-Forwarded-For header. Now X-Forwarded-For is only honored when the connecting peer address matches an entry in trusted_proxies_.
