Method CheckClientAccess

Modules/RESTAPI/src/mitkRestServer.cpp:618–660

// --- Security middleware implementations ---

bool RestServer::CheckClientAccess(const httplib::Request& req, httplib::Response& res)
{
  // Access m_RunningConfig without lock - called from httplib worker thread.
  // m_RunningConfig is set before the server starts accepting connections
  // and cleared after the server stops, so it is safe to read here.
  const auto& config = *m_RunningConfig;

  switch (config.clientAccessMode)
  {
    case ClientAccessMode::AllowAll:
      return true;

    case ClientAccessMode::LocalhostOnly:
      if (IsLocalhostIP(req.remote_addr))
      {
        return true;
      }
      break;

    case ClientAccessMode::Whitelist:
    {
      const auto& allowedIPs = config.allowedClientIPs;
      if (std::find(allowedIPs.begin(), allowedIPs.end(), req.remote_addr) != allowedIPs.end())
      {
        return true;
      }
      break;
    }

    default:
      MITK_WARN << "Unknown clientAccessMode value: " << static_cast<int>(config.clientAccessMode);
      break;
  }

  // Denied
  auto error = ErrorResponse::AccessDenied(
    "Client IP " + SanitizeForLog(req.remote_addr) + " is not allowed", req.path);
  res.status = 403;
  res.set_content(error.dump(), "application/json");

  this->RecordRequest(req.path, req.method, res.status, req.remote_addr);
  return false;
}

bool RestServer::CheckRateLimit(const httplib::Request& req, httplib::Response& res)
{