blackbull.middleware.proxy

blackbull.middleware.proxy

Trusted-proxy address, scheme and prefix recovery.

Only configured trusted peers may supply forwarding headers; accepting headers from arbitrary peers permits spoofing.

TrustedProxy

Rewrite conn.client and conn.scheme only behind configured trusted peers.

Proxies must append the observed peer or overwrite the chain. Standalone proto/prefix assertions must replace client-supplied values. Forwarded takes precedence over X-Forwarded-For/Proto; walk right to left to the first untrusted IP. Trust defaults to loopback. See the reverse-proxy guide.