Dmitry VerkhoturovandUmputun
b1502801fa
Rate limiting and (with --votes-ip) vote de-duplication key on the client IP, recovered from forwarding headers (X-Real-IP / X-Forwarded-For / CF-Connecting-IP) when behind a reverse proxy. Those headers were accepted from any client, so a caller could set them to change its apparent IP. Add --trusted-proxy / TRUSTED_PROXY (comma-separated CIDR/IP): forwarding headers are honored only when the direct peer is a trusted proxy; other peers keep their real socket address. Unset preserves the previous trust-all behavior (with a startup warning) so existing deployments keep working on upgrade. Docs: a 'Trusted proxies and client IP' section with per-topology guidance, plus a note in the nginx manual.
Remark42 site
Work on your local environment
Requirements:
- Node.js v20 or higher - install from package or with Homebrew
- Yarn 1.22 or higher - once you have Node.js, run
npm i -g yarn
Development
Install dependencies and start the development server:
yarn
yarn dev
Build
yarn build
Work with Docker Compose
Build
Install dependencies and run development server inside Docker:
docker compose build
docker compose up server
Then serve files from ./build with your favorite server
Development
docker compose up --build server
Then head to http://localhost:8080