From 17365f4304ee558e83380eb5913c1af7466f0706 Mon Sep 17 00:00:00 2001 From: Dmitry Verkhoturov Date: Tue, 30 Jun 2026 22:31:06 +0100 Subject: [PATCH] Replace chi middleware.RealIP with rest.RealIP on the main router Behaviour-preserving swap: rest.RealIP sets r.RemoteAddr from X-Real-IP / X-Forwarded-For like chi's middleware.RealIP, removing chi from the RealIP path without changing the trust model (GHSA-56x6-q882-mf27 stays present, to be fixed separately). chi/middleware stays imported for Timeout; whichever of this PR and the Timeout PR (#2097) merges last drops the import. Drop-in to a tested rest middleware; covered by existing api router tests. --- backend/app/rest/api/rest.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/backend/app/rest/api/rest.go b/backend/app/rest/api/rest.go index fe60d616..f5dbf987 100644 --- a/backend/app/rest/api/rest.go +++ b/backend/app/rest/api/rest.go @@ -221,7 +221,7 @@ func (s *Rest) routes() chi.Router { s.openRouteLimiter = openRouteLimiter } router := chi.NewRouter() - router.Use(R.Throttle(1000), middleware.RealIP, R.Recoverer(log.Default())) + router.Use(R.Throttle(1000), R.RealIP, R.Recoverer(log.Default())) router.Use(securityHeadersMiddleware(s.ExternalImageProxy, s.AllowedAncestors)) if !s.DisableSignature { router.Use(R.AppInfo("remark42", "umputun", s.Version)) @@ -785,7 +785,7 @@ func parseError(err error, defaultCode int) (code int) { // rateLimiter creates a rate limiting middleware with proper IP lookup configuration. // tollbooth v8 requires explicit IP lookup method to be set. -// uses RemoteAddr which is set by chi's middleware.RealIP to the real client IP +// uses RemoteAddr which is set by rest.RealIP to the real client IP // from X-Forwarded-For, X-Real-IP, or True-Client-IP headers. func rateLimiter(maxReq float64) func(http.Handler) http.Handler { lmt := tollbooth.NewLimiter(maxReq, nil)