Chi: Client IP Spoofing In ClientIPFromXFF Via X-Forwarded-For

Summary "ClientIPFromXFF" skips any "X-Forwarded-For" entry in a configured trusted CIDR but never verifies that the direct TCP peer in "http.Request.RemoteAddr" belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose th...