[harsh21234i]

Summary

Fixes #7601. router.session.client_ip previously trusted the leftmost X-Forwarded-For value, which clients can spoof.

The connection peer address is now used by default. Applications behind trusted reverse proxies can set trusted_proxy_hops to select the client address from the forwarded chain.

Changes

• Add trusted_proxy_hops, defaulting to 0; reject negative and non-integer values.
• Use the configured hop count to read the address from the right side of X-Forwarded-For. Fall back to the connection peer if the header is missing or too short.
• Document the setting and its proxy-trust requirements.
• Add regression tests and changelog entries for reflex and reflex-base.

Testing

• tests/units/test_app.py and tests/units/test_config.py: 350 passed, 2 skipped
• Pyright, Ruff, and codespell passed

[cubic-dev-ai]

All reported issues were addressed across 8 files

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge, with no outstanding findings.

Summary

The PR makes router.session.client_ip ignore forwarded headers by default. Apps behind trusted proxies can opt in with trusted_proxy_hops.

• Client IPs come from the connection peer unless trusted proxy hops are configured.

No new actionable issues were found in the changes since the previous review.

_{Reviews (2) · Last reviewed commit: "fix: address trusted proxy review feedba..." · Reviewed by Greptile}

[codspeed]

Merging this PR will not alter performance

⚠️ 10 benchmarks spent significant time in system calls

System calls cannot be consistently instrumented, so they are not included in the measure, which understates the real cost. Please switch to the Walltime instrument to accurately measure system calls.

Measurement and system calls

• test_import_cli
• test_cli_startup[run_help]
• test_cli_startup[version]
• test_cli_startup[help]
• test_cli_startup[cloud_help]
• test_emit_update
• test_cli_startup[deploy_help]
• test_set_state[disk]
• test_modify_state[disk]
• test_python_process_startup

✅ 148 untouched benchmarks

---

_{Comparing harsh21234i:fix/7601-trusted-proxy-client-ip (5ca62ee) with main (d3f4ab1)}

[masenf]

thanks for implementing this security enhancement