From 6607d4c0d6c82ae34bd7377038f19ac63b576352 Mon Sep 17 00:00:00 2001 From: Sven van Ginkel Date: Fri, 14 Aug 2026 16:13:26 +0200 Subject: [PATCH] fix(hub): check X-Real-IP header to resolve agent's real source IP (#1973) --- internal/hub/agent_connect.go | 3 +++ internal/hub/agent_connect_test.go | 18 ++++++++++++++++++ 2 files changed, 21 insertions(+) diff --git a/internal/hub/agent_connect.go b/internal/hub/agent_connect.go index bf690c6b..0d55ce07 100644 --- a/internal/hub/agent_connect.go +++ b/internal/hub/agent_connect.go @@ -317,6 +317,9 @@ func getRealIP(r *http.Request) string { if ip := r.Header.Get("CF-Connecting-IP"); ip != "" { return ip } + if ip := r.Header.Get("X-Real-IP"); ip != "" { + return ip + } if ip := r.Header.Get("X-Forwarded-For"); ip != "" { // X-Forwarded-For can contain a comma-separated list: "client_ip, proxy1, proxy2" // Take the first one diff --git a/internal/hub/agent_connect_test.go b/internal/hub/agent_connect_test.go index ff65e428..c07849cb 100644 --- a/internal/hub/agent_connect_test.go +++ b/internal/hub/agent_connect_test.go @@ -1796,6 +1796,24 @@ func TestGetRealIP(t *testing.T) { remoteAddr: "127.0.0.1:12345", expectedIP: "192.168.1.8", }, + { + name: "X-Real-IP header", + headers: map[string]string{"X-Real-IP": "10.8.0.4"}, + remoteAddr: "172.21.0.1:12345", + expectedIP: "10.8.0.4", + }, + { + name: "X-Real-IP takes precedence over X-Forwarded-For", + headers: map[string]string{"X-Real-IP": "10.8.0.4", "X-Forwarded-For": "10.8.0.5"}, + remoteAddr: "172.21.0.1:12345", + expectedIP: "10.8.0.4", + }, + { + name: "CF-Connecting-IP takes precedence over X-Real-IP", + headers: map[string]string{"CF-Connecting-IP": "1.2.3.4", "X-Real-IP": "10.8.0.4"}, + remoteAddr: "172.21.0.1:12345", + expectedIP: "1.2.3.4", + }, } for _, tc := range testCases {