Honor trusted proxy client IP headers

karldns/security.py

@@ -146,9 +146,11 @@ def require_admin_csrf(settings: DdnsSettings, supplied: str) -> None:
 
 def client_ip(request: Request, settings: DdnsSettings | None = None) -> str:
     peer = request.client.host if request.client else "unknown"
-    forwarded = request.headers.get("x-forwarded-for", "")
-    if forwarded and settings and _trusted_proxy(peer, settings.trusted_proxy_ips):
-        return forwarded.split(",", 1)[0].strip()
+    if settings and _trusted_proxy(peer, settings.trusted_proxy_ips):
+        for header_name in ("cf-connecting-ip", "x-forwarded-for", "x-real-ip"):
+            candidate = request.headers.get(header_name, "")
+            if candidate:
+                return candidate.split(",", 1)[0].strip()
     return peer