Function clientIP

internal/httpapi/ratelimit.go:147–155

clientIP extracts the caller IP for per-IP limiting. It trusts only CF-Connecting-IP (set by Cloudflare and stripped from inbound requests at the edge), NOT X-Forwarded-For: an attacker can prepend an arbitrary XFF entry and Cloudflare appends the real client IP rather than replacing it, so the left

(r *http.Request)

// to XFF. Mirrors agent.clientIP and oauth dcrSourceIP so every per-IP
// limiter keys identically.
func clientIP(r *http.Request) string {
	if ip := strings.TrimSpace(r.Header.Get("CF-Connecting-IP")); ip != "" {
		return ip
	}
	if host, _, err := net.SplitHostPort(r.RemoteAddr); err == nil {
		return host
	}
	return r.RemoteAddr
}