molecule-ai/molecule-core
35
0
Fork 2
Code Issues 16 Pull Requests 2 Actions 49 Packages Projects Releases Wiki Activity
06e02a310c
molecule-core/platform/internal
History
Backend Engineer 06e02a310c fix(router): call SetTrustedProxies(nil) to close IP-spoofing bypass (#179) 
Without this call Gin's default trusts all X-Forwarded-For headers, letting
any caller rotate their effective IP and bypass per-IP rate limiting.
SetTrustedProxies(nil) forces c.ClientIP() to always return the real
TCP RemoteAddr.

Adds two regression tests: one documenting the pre-fix bypass, one
asserting the spoofed header is ignored after the fix.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-15 17:32:54 +00:00
..
bundle initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
channels initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
crypto initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
db initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
envx initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
events initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
handlers Merge pull request #162 from Molecule-AI/fix/issue-138-field-whitelist 2026-04-15 09:39:22 -07:00
metrics initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
middleware fix(router): call SetTrustedProxies(nil) to close IP-spoofing bypass (#179) 2026-04-15 17:32:54 +00:00
models initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
plugins initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
provisioner Merge pull request #57 from Molecule-AI/fix/issue-12-preserve-claude-sessions 2026-04-14 12:26:12 -07:00
registry fix(registry): allow ancestor↔descendant A2A so audit_summary can reach PM 2026-04-14 22:18:38 -07:00
router fix(router): call SetTrustedProxies(nil) to close IP-spoofing bypass (#179) 2026-04-15 17:32:54 +00:00
scheduler Merge branch 'main' into fix/111-112-clean 2026-04-15 09:36:14 -07:00
supervised fix(platform): panic-recovering supervisor for every background goroutine (#92) 2026-04-14 20:34:18 -07:00
ws initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
wsauth fix(security): protect global secrets routes with AdminAuth middleware (Cycle 7) 2026-04-14 06:33:22 +00:00