fix: Enhance error handling and security measures across various endpoints - #251
Open
cguleroglu wants to merge 1 commit into
Open
fix: Enhance error handling and security measures across various endpoints#251cguleroglu wants to merge 1 commit into
cguleroglu wants to merge 1 commit into
Conversation
…oints - Updated error responses to avoid leaking internal error messages in vector providers. - Changed rate limiter to use shared cache for distributed deployments. - Added validation for PostgreSQL table names to prevent SQL injection. - Implemented DNS-aware URL safety checks to mitigate SSRF risks. - Improved logging for authentication failures and token usage. - Enhanced Content Security Policy in middleware for better security.
5 tasks
anilguleroglu
added a commit
that referenced
this pull request
Sep 6, 2026
…tion (F-09) (#279) * fix(security): configurable proxy trust boundary for client IP resolution (F-09) The remaining half of F-09 not covered by the open, conflicting PR #251 (which fixes the auth rate limiter's process-local counter but does not touch IP trust at all). - getClientIp() read the raw X-Forwarded-For header directly and trusted its leftmost value unconditionally -- any caller who could reach this process at all (not only one behind the real reverse proxy) could set an arbitrary IP. This fed both the auth rate limiter's bucket key (spoof a new IP, get a fresh rate-limit window) and audit IP logging (spoof any IP into the audit trail). Fastify's own `request.ip` already exists specifically to answer this correctly given a configured trust boundary -- getClientIp() now prefers it, falling back to raw header parsing only when it is unavailable. - `trustProxy: true` was hardcoded, telling Fastify to trust every hop regardless of whether a real proxy sits in front of this process. Added `network.trustedProxies` (TRUSTED_PROXIES: comma-separated IPs/CIDRs, or a single integer for a hop count) so an operator with a real reverse proxy/load balancer can scope trust to it. Unset (default) preserves the exact current `trustProxy: true` behaviour -- this is an opt-in hardening lever, not a default-behavior change, since flipping the default would silently break IP-based rate limiting and audit logging for every deployment that legitimately sits behind a proxy today. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KQq6TnVNHRNU6Wz1eQzPpD * review: drop the header fallbacks getClientIp no longer needs Pre-merge review of this PR: with `request.ip` checked first, the X-Forwarded-For and X-Real-IP branches below it are unreachable (`request.ip` falls back to the socket address on its own) — and if one ever did run, it would do the exact thing this PR exists to stop: believe a header the caller can set, regardless of the trustProxy boundary. Removed, leaving `request.ip || 'unknown'`. Deployment note now in the function's doc comment: a proxy that sets ONLY X-Real-IP (no X-Forwarded-For) will show up as the proxy's own address — set X-Forwarded-For on it and list the proxy in TRUSTED_PROXIES. The two tests that asserted the removed fallbacks now assert the opposite (a spoofable header is never read here). Test plan: 7/7 in trust-proxy-and-client-ip.test.ts; full suite 5053 passed, 5 skipped, 0 failed; tsc + eslint clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KQq6TnVNHRNU6Wz1eQzPpD --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Describe the problem and the change in one or two paragraphs.
Changes
Validation
npm run lintnpm run testnpm run buildnpm run docs:buildRelease Notes