You'll noticeTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
ElsewhereArea: what it touches
ImprovementsKind: in v2.1.318,
ImprovementsSection of the release
What
The self-hosted gateway's warning text changed. It used to tell you to add your load balancer's address range to listen.trusted_proxies with no caveat. It now says to list the load balancer there only if it adds the connecting address to the X-Forwarded-For header itself, and warns that otherwise clients can fake their address. The X-Forwarded-For header is where proxies record the original address of a request. Only the wording changed.
Why
Following the old advice with a load balancer that passes the header through unchanged would let clients pretend to come from any address, which matters for anything that relies on client addresses, such as rate limits.
Read from
Names in the bundlelisten.trusted_proxies
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agreeGateway: Improved the log hints about listen.trusted_proxies: they now say to list only a proxy that adds the connecting address to…
