LocalAI

0 Fork 0

mirror of https://github.com/mudler/LocalAI.git synced 2026-11-06 04:23:15 -05:00

Files

T

Ettore Di Giacinto f5f4b7ea58 feat(http): add --trusted-proxies to resolve the real client address

Echo's RealIP trusted X-Forwarded-For and X-Real-Ip from any peer
when no IPExtractor is set. That fed the login and registration rate
limits and the API trace client address, so a client could dodge a
limit by rotating a forged header.

Add pkg/clientip, one resolver for the whole server. With
--trusted-proxies / LOCALAI_TRUSTED_PROXIES (IPs and CIDRs, empty by
default), the forwarded chain is read only when the TCP peer is
listed. The client is the right-most X-Forwarded-For entry that is
not a trusted proxy; a malformed entry stops the walk. With the flag
unset every request resolves to its TCP peer.

The resolver is set as Echo's IPExtractor and used by the access log
(--log-client), so all consumers agree.

Assisted-by: Claude:claude-sonnet-5-5 go gofmt

2026-11-03 15:48:38 +00:00

application

fix(connectors): hold add-on write tools to tools.write in connector chats

2026-11-03 15:41:45 +00:00

backend

feat(realtime): LFM3-Audio speech-to-speech on llama.cpp, remove liquid-audio (#12958 )

2026-10-29 22:06:41 +01:00

cli

feat(http): add --trusted-proxies to resolve the real client address

2026-11-03 15:48:38 +00:00

clients

security(http): refuse redirects on outbound clients via hardened pkg/httpclient (#10087 )