You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
ElsewhereArea: what it touches
Bug FixesKind: in v2.1.261,
Bug FixesSection of the release
The standalone claude gateway server now validates the X-Forwarded-For header from trusted proxies. If a trusted proxy sends a value that can't be parsed as an IP and access_control (allow/deny CIDRs) is configured, the request is denied with a 403 instead of silently falling back to the proxy's own address for rate limiting and audit purposes. Requests where the client IP can't be determined at all are now also explicitly denied (client_ip_unknown) when access control is active.
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agreeFixed Claude apps gateway client IP when a trusted proxy appends a port to X-Forwarded-For; with an access list set, an unreadable entry now…
