2 Commits

Include renames

Author	SHA1	Message	Date
bvandeusenandClaude Opus 5.5	3c01e17559	test(6838): give the test request its socket peer the way Quart reads it ... Quart takes remote_addr from a Remote-Addr header its ASGI layer writes from the scope (replacing any the client sent). A test request context does not read scope_base for it, so the two socket-peer tests saw an empty address. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-04 19:37:28 -05:00
bvandeusenandClaude Opus 5.5	dbd6d5b8b5	feat(6838): read the client address and HTTPS from the trusted proxy hop ... grimoire/proxy.py is the one reader of X-Forwarded-For and X-Forwarded-Proto. It takes the entry TRUSTED_PROXY_HOPS in from the right (default 1; a shorter header reads its leftmost entry; 0 trusts no proxy), so an entry a client puts left of the proxy's is never believed. Before this, with TRUST_PROXY_HEADERS on, the leftmost X-Forwarded-For entry keyed the login, register, forgot and reset rate limits and the audit log, and a client could choose it. The session cookie is Secure, and HSTS (max-age=31536000) is sent, exactly when the request is HTTPS by the trusted proxy's word. Plain HTTP is untouched and nothing redirects. SECURE_COOKIES is gone (a startup warning says so when it is still set); TRUST_PROXY_HEADERS=false still maps to 0 hops, with a warning to move to TRUSTED_PROXY_HOPS. Admin audit lines now use the same client address instead of the socket peer. The placeholder-key refusal keyed on SECURE_COOKIES, so it now refuses either placeholder key outright; the instance makes its own key when none is set. Family idea #5004 (IsHTTPS, trusted-hop X-Forwarded-Proto), canon v2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-04 19:32:20 -05:00