Backend Engineer 1ad98be17b fix(router): call SetTrustedProxies(nil) to close IP-spoofing bypass (#179) ... Without this call Gin's default trusts all X-Forwarded-For headers, letting any caller rotate their effective IP and bypass per-IP rate limiting. SetTrustedProxies(nil) forces c.ClientIP() to always return the real TCP RemoteAddr. Adds two regression tests: one documenting the pre-fix bypass, one asserting the spoofed header is ignored after the fix. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>		2026-04-15 17:32:54 +00:00
..
router.go	fix(router): call SetTrustedProxies(nil) to close IP-spoofing bypass (#179)	2026-04-15 17:32:54 +00:00