kb topic search + client-ip port strip + application notes html

shopdb/core/api/auth.py

@@ -26,11 +26,10 @@ LOCKOUT_MINUTES = 15
 
 
 def _login_ip():
-    """Caller IP for rate limiting, honoring the first X-Forwarded-For hop."""
-    forwarded = request.headers.get('X-Forwarded-For')
-    if forwarded:
-        return forwarded.split(',')[0].strip()
-    return request.remote_addr or 'unknown'
+    """Caller IP for rate limiting, port stripped so the key is per-host, not
+    per-connection (ARR forwards clientip:port with an ephemeral port)."""
+    from shopdb.utils.clientip import client_ip
+    return client_ip(request) or 'unknown'
 
 
 def _login_ratelimited():