Skip to content

fix: Non-standard X-Forwarded-For header content is not supported#4575

Open
dusk5213 wants to merge 2 commits intogin-gonic:masterfrom
dusk5213:fix_gin_validate_header
Open

fix: Non-standard X-Forwarded-For header content is not supported#4575
dusk5213 wants to merge 2 commits intogin-gonic:masterfrom
dusk5213:fix_gin_validate_header

Conversation

@dusk5213
Copy link

This PR fixes the issue reported in #4572.

Changes include:

1. Support IPv6 addresses with brackets

  • Previously, c.GetClientIP() could not recognize addresses like [240e:318:2f4a:de56::240]. They are now parsed correctly.

2. Support IPv4/IPv6 addresses with port numbers

  • Fixed the issue where X-Forwarded-For headers containing ports, common in IIS, ARR, or cloud load balancer scenarios, could not be recognized, e.g.:
127.0.0.1:38792
[240e:318:2f4a:de56::240]:38792

3. Preserve original behavior

  • Plain IPv4 and IPv6 addresses are still recognized as before.

4. Add regression tests

  • Covers the above problem cases as well as normal cases to ensure the fix works and does not break existing functionality.
    This change only affects the parsing logic in validateHeader and does not impact other features.

@codecov
Copy link

codecov bot commented Mar 10, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.32%. Comparing base (3dc1cd6) to head (e4e3634).
⚠️ Report is 268 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #4575      +/-   ##
==========================================
- Coverage   99.21%   98.32%   -0.90%     
==========================================
  Files          42       48       +6     
  Lines        3182     3155      -27     
==========================================
- Hits         3157     3102      -55     
- Misses         17       43      +26     
- Partials        8       10       +2     
Flag Coverage Δ
?
--ldflags="-checklinkname=0" -tags sonic 98.30% <100.00%> (?)
-tags go_json 98.17% <100.00%> (?)
-tags nomsgpack 98.23% <100.00%> (?)
go-1.18 ?
go-1.19 ?
go-1.20 ?
go-1.21 ?
go-1.25 98.25% <100.00%> (?)
go-1.26 98.32% <100.00%> (?)
macos-latest 98.25% <100.00%> (-0.96%) ⬇️
ubuntu-latest 98.32% <100.00%> (-0.90%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant