{"version":"2.1.261","anchor":"gateway-proxy-hardens-x-forwarded-for-handling","canonical_anchor":"gateway-proxy-hardens-x-forwarded-for-handling","heading":"Gateway proxy hardens X-Forwarded-For handling","tier":"notice","area":"Elsewhere","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.261\/e\/gateway-proxy-hardens-x-forwarded-for-handling","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.261","markdown":"### Gateway proxy hardens X-Forwarded-For handling\n\nThe gateway server now denies requests with unparseable or unknown client IPs when access control is on.\n\nThe standalone `claude gateway` server now validates the `X-Forwarded-For` header from trusted proxies. If a trusted proxy sends a value that can't be parsed as an IP and `access_control` (allow\/deny CIDRs) is configured, the request is denied with a 403 instead of silently falling back to the proxy's own address for rate limiting and audit purposes. Requests where the client IP can't be determined at all are now also explicitly denied (`client_ip_unknown`) when access control is active.\n\n- Area: Elsewhere\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5"}