fix(web): read the client address from the proxy end of forwarded headers

getRemoteIp took a trusted proxy's X-Real-IP first, otherwise the leftmost
X-Forwarded-For entry. A proxy that forwards a client-sent X-Real-IP
unchanged (Caddy, HAProxy) or appends to X-Forwarded-For leaves both values
to the client. X-Forwarded-For is now read from the right, skipping trusted
proxies. X-Real-IP is believed only when it agrees with that hop or stands
alone, and a disagreement falls back to the proxy's own address.

The documented Caddyfile and the docs reverse-proxy generator now overwrite
X-Real-IP with the address Caddy saw.

docs/content/docs/en/operations/reverse-proxy.mdx

@@ -38,7 +38,9 @@ and it just works:
 
 ```text title="Caddyfile"
 panel.example.com {
-    reverse_proxy 127.0.0.1:2053
+    reverse_proxy 127.0.0.1:2053 {
+        header_up X-Real-IP {remote_host}
+    }
 }
 ```
 

docs/content/docs/fa/operations/reverse-proxy.mdx

@@ -38,7 +38,9 @@ Caddy گواهی‌ها را برای شما دریافت و تمدید می‌
 
 ```text title="Caddyfile"
 panel.example.com {
-    reverse_proxy 127.0.0.1:2053
+    reverse_proxy 127.0.0.1:2053 {
+        header_up X-Real-IP {remote_host}
+    }
 }
 ```
 

docs/content/docs/ru/operations/reverse-proxy.mdx

@@ -39,7 +39,9 @@ Caddy получает и продлевает сертификаты за ва
 
 ```text title="Caddyfile"
 panel.example.com {
-    reverse_proxy 127.0.0.1:2053
+    reverse_proxy 127.0.0.1:2053 {
+        header_up X-Real-IP {remote_host}
+    }
 }
 ```
 

docs/content/docs/zh/operations/reverse-proxy.mdx

@@ -33,7 +33,9 @@ Caddy 会为你获取并续期证书——只需让 Caddyfile 指向面板，它
 
 ```text title="Caddyfile"
 panel.example.com {
-    reverse_proxy 127.0.0.1:2053
+    reverse_proxy 127.0.0.1:2053 {
+        header_up X-Real-IP {remote_host}
+    }
 }
 ```
 

docs/lib/xray/reverse-proxy.test.ts

@@ -31,6 +31,15 @@ describe('buildProxyConfig — caddy', () => {
     const cfg = buildProxyConfig({ ...base, server: 'caddy', panelPath: '/' });
     expect(cfg).toContain('reverse_proxy 127.0.0.1:2053');
   });
+
+  // Caddy forwards a client-sent X-Real-IP unchanged, and the panel's login
+  // limiter would key on it; only an overwrite gives the address Caddy saw.
+  it('overwrites X-Real-IP with the address Caddy saw', () => {
+    for (const panelPath of ['/', '/panel']) {
+      const cfg = buildProxyConfig({ ...base, server: 'caddy', panelPath });
+      expect(cfg).toContain('header_up X-Real-IP {remote_host}');
+    }
+  });
 });
 
 describe('buildCertCommand', () => {

docs/lib/xray/reverse-proxy.ts

@@ -49,14 +49,12 @@ function buildNginx(o: ReverseProxyOptions): string {
 
 function buildCaddy(o: ReverseProxyOptions): string {
   const path = normalizePath(o.panelPath);
-  if (path === '/') {
-    return `${o.domain} {
-    reverse_proxy 127.0.0.1:${o.panelPort}
-}`;
-  }
-  const matcher = `${path.replace(/\/$/, '')}/*`;
+  const matcher = path === '/' ? '' : `${path.replace(/\/$/, '')}/* `;
+  // Caddy forwards a client-sent X-Real-IP as is; the panel's login limiter reads it.
   return `${o.domain} {
-    reverse_proxy ${matcher} 127.0.0.1:${o.panelPort}
+    reverse_proxy ${matcher}127.0.0.1:${o.panelPort} {
+        header_up X-Real-IP {remote_host}
+    }
 }`;
 }
 

internal/web/controller/util.go

@@ -22,24 +22,43 @@ func getRemoteIp(c *gin.Context) string {
 	if !ok {
 		return "unknown"
 	}
-
-	if isTrustedProxy(remoteIP) {
-		if ip, ok := extractTrustedIP(c.GetHeader("X-Real-IP")); ok {
-			return ip
-		}
-
-		if xff := c.GetHeader("X-Forwarded-For"); xff != "" {
-			for part := range strings.SplitSeq(xff, ",") {
-				if ip, ok := extractTrustedIP(part); ok {
-					return ip
-				}
-			}
-		}
+	if !isTrustedProxy(remoteIP) {
+		return remoteIP
 	}
 
+	realIP, hasRealIP := extractTrustedIP(c.GetHeader("X-Real-IP"))
+	forwardedIP, hasForwarded := forwardedForClient(c.GetHeader("X-Forwarded-For"))
+	switch {
+	case hasRealIP && hasForwarded && realIP != forwardedIP:
+		// A proxy rewrites at most one of the two, so the other is the client's
+		// own claim; neither may pick the identity the login limiter keys on.
+		return remoteIP
+	case hasForwarded:
+		return forwardedIP
+	case hasRealIP:
+		return realIP
+	}
 	return remoteIP
 }
 
+// forwardedForClient walks X-Forwarded-For from the proxy end: entries a client sent
+// come first, so the first hop that is not a trusted proxy is the address one saw.
+func forwardedForClient(xff string) (string, bool) {
+	parts := strings.Split(xff, ",")
+	client := ""
+	for i := len(parts) - 1; i >= 0; i-- {
+		ip, ok := extractTrustedIP(parts[i])
+		if !ok {
+			break
+		}
+		client = ip
+		if !isTrustedProxy(ip) {
+			break
+		}
+	}
+	return client, client != ""
+}
+
 func isTrustedForwardedRequest(c *gin.Context) bool {
 	remoteIP, ok := extractTrustedIP(c.Request.RemoteAddr)
 	return ok && isTrustedProxy(remoteIP)

internal/web/controller/util_test.go

@@ -33,6 +33,35 @@ func TestGetRemoteIpHonorsForwardedHeadersFromTrustedLoopbackProxy(t *testing.T)
 	}
 }
 
+// Caddy and HAProxy set X-Forwarded-For but pass the client's own X-Real-IP
+// through, so a client could pick its login-limiter bucket per request.
+func TestGetRemoteIpDistrustsRealIPThatContradictsForwardedFor(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	c, _ := gin.CreateTestContext(httptest.NewRecorder())
+	c.Request = httptest.NewRequest(http.MethodGet, "/", nil)
+	c.Request.RemoteAddr = "127.0.0.1:12345"
+	c.Request.Header.Set("X-Forwarded-For", "203.0.113.5")
+	c.Request.Header.Set("X-Real-IP", "198.51.100.1")
+
+	if got := getRemoteIp(c); got != "127.0.0.1" {
+		t.Fatalf("remote IP = %q, want the proxy address when the forwarded headers disagree", got)
+	}
+}
+
+// An appending proxy keeps whatever X-Forwarded-For the client sent in front of
+// the address it saw, so only the hop next to the trusted proxies is real.
+func TestGetRemoteIpReadsForwardedForFromTheProxyEnd(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	c, _ := gin.CreateTestContext(httptest.NewRecorder())
+	c.Request = httptest.NewRequest(http.MethodGet, "/", nil)
+	c.Request.RemoteAddr = "127.0.0.1:12345"
+	c.Request.Header.Set("X-Forwarded-For", "198.51.100.1, 203.0.113.5")
+
+	if got := getRemoteIp(c); got != "203.0.113.5" {
+		t.Fatalf("remote IP = %q, want the hop the trusted proxy appended", got)
+	}
+}
+
 func TestResolveHostPrefersForwardedHostOverRealIP(t *testing.T) {
 	gin.SetMode(gin.TestMode)
 	c, _ := gin.CreateTestContext(httptest.NewRecorder())