From 2fda94f67a62a552fdf12c606a9f0daf7e60fcce Mon Sep 17 00:00:00 2001
From: Cam Proudlock <cam.proudlock@gmail.com>
Date: Thu, 16 Jul 2026 15:27:45 -0400
Subject: [PATCH] Forward real client IPs through waitress trusted-proxy flags

The X-Forwarded-For rewrite rule alone is not enough: waitress 2+
strips forwarded headers from untrusted proxies by default, so the app
still saw 127.0.0.1 with the rule active. Trust the loopback proxy and
consume x-forwarded-for on the waitress command line.
---
 deploy/windows/web.config | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/windows/web.config b/deploy/windows/web.config
index fe712b0d..4821797c 100644
--- a/deploy/windows/web.config
+++ b/deploy/windows/web.config
@@ -28,7 +28,7 @@
 
     <httpPlatform
         processPath="C:\shopdb-flask\venv\Scripts\waitress-serve.exe"
-        arguments="--port=%HTTP_PLATFORM_PORT% --host=127.0.0.1 --threads=8 wsgi:app"
+        arguments="--port=%HTTP_PLATFORM_PORT% --host=127.0.0.1 --threads=8 --trusted-proxy=127.0.0.1 --trusted-proxy-headers=x-forwarded-for wsgi:app"
         stdoutLogEnabled="true"
         stdoutLogFile="C:\shopdb-flask\logs\httpplatform"
         startupTimeLimit="120"