httpx

func ParseTrustedProxies ¶

func ParseTrustedProxies(specs []string) ([]netip.Prefix, error)

ParseTrustedProxies converts config strings into prefixes, rejecting anything that is not a valid CIDR (or bare IP, treated as /32 or /128). Invalid input is a configuration error, never silently ignored — a typo must not widen trust.

func ResolveClientIP ¶

func ResolveClientIP(trusted []netip.Prefix) func(http.Handler) http.Handler

ResolveClientIP returns the middleware that stamps the rate-limit and audit client IP into r.RemoteAddr (host-only, like the previous realIP middleware).

Default (no trusted prefixes configured): the TCP peer address ONLY — X-Forwarded-For is ignored entirely, so a client can never spoof its identity past the rate limiter.

With trusted prefixes: when the immediate peer falls inside one, the client IP is the LAST (right-most) X-Forwarded-For hop — the hop the trusted proxy itself appended; earlier entries remain client-controlled and are never trusted. A malformed or empty XFF keeps the peer address. Loopback proxies are NOT implicitly trusted — an operator must name them explicitly (fail-closed by configuration).

func SecurityHeaders ¶

func SecurityHeaders(next http.Handler) http.Handler

SecurityHeaders sets the conservative response headers every GSEER web surface carries (M16 regression-pinned):

• X-Content-Type-Options: nosniff — responses are never MIME-sniffed
• X-Frame-Options: DENY — GSEER UI is never framed
• Referrer-Policy: no-referrer — queries (which can contain operator research) never leak via Referer to other origins
• Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; img-src data:; form-action 'self'; base-uri 'none'; frame-ancestors 'none' — the dashboard is server-rendered with inline CSS and zero scripts; this denies script injection even if an escaping bug ever appears.

The headers are set on every response (they are cheap and the value is failing closed).