kb topic search + client-ip port strip + application notes html

shopdb/core/api/auth.py

@@ -26,11 +26,10 @@ LOCKOUT_MINUTES = 15
 
 
 def _login_ip():
-    """Caller IP for rate limiting, honoring the first X-Forwarded-For hop."""
-    forwarded = request.headers.get('X-Forwarded-For')
-    if forwarded:
-        return forwarded.split(',')[0].strip()
-    return request.remote_addr or 'unknown'
+    """Caller IP for rate limiting, port stripped so the key is per-host, not
+    per-connection (ARR forwards clientip:port with an ephemeral port)."""
+    from shopdb.utils.clientip import client_ip
+    return client_ip(request) or 'unknown'
 
 
 def _login_ratelimited():

shopdb/core/api/dashboarddefaults.py

@@ -17,11 +17,10 @@ dashboarddefaults_bp = Blueprint('dashboarddefaults', __name__)
 
 
 def _request_ip():
-    """Caller IP, honoring a single proxy hop via X-Forwarded-For."""
-    forwarded = request.headers.get('X-Forwarded-For')
-    if forwarded:
-        return forwarded.split(',')[0].strip()
-    return request.remote_addr
+    """Caller IP for the IP fallback, port stripped so it matches a stored
+    (portless) DashboardDefault.ipaddress. ARR forwards clientip:port."""
+    from shopdb.utils.clientip import client_ip
+    return client_ip(request)
 
 
 def _serialize(default):

shopdb/core/models/auditlog.py

@@ -117,10 +117,9 @@ class AuditLog(db.Model):
         useragent = None
 
         if request_obj:
-            # Handle proxy forwarding
-            ipaddress = request_obj.headers.get('X-Forwarded-For', request_obj.remote_addr)
-            if ipaddress and ',' in ipaddress:
-                ipaddress = ipaddress.split(',')[0].strip()
+            # First-hop client IP, port stripped (ARR forwards clientip:port).
+            from shopdb.utils.clientip import client_ip
+            ipaddress = client_ip(request_obj)
             useragent = request_obj.headers.get('User-Agent', '')[:255]
 
         entry = cls(