calvin.erfmann/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-08-14 00:09:55 +02:00
Code Issues Packages Projects Releases Wiki Activity

optionally stamp ip header for downstream use

Browse Source
This commit is contained in:
Owen
2026-08-13 09:14:37 -04:00
parent 5fbb205044
commit 7291628f86
5 changed files with 91 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/routers/aiGateway/pipeline.ts
+9 -2
View File
@@ -42,6 +42,7 @@ import { localCache } from "@server/lib/cache";
import {
AI_GATEWAY_TRUST_HEADER,
AI_GATEWAY_RESOURCE_TYPE_HEADER,
AI_GATEWAY_CLIENT_IP_HEADER,
isAiGatewayTrustHeaderValid,
getAiGatewayResourceType,
type AiGatewayResourceType
@@ -303,7 +304,12 @@ async function resolveRequestUser(
return { user: null, virtualApiKeyId: null };
}
const ip = req.ip;
// Prefer the dedicated header Badger stamps at the Traefik hop (opt-in
// via server.enable_ai_gateway_client_ip_header) over req.ip, since an
// intermediary proxy between Traefik and this gateway may overwrite
// X-Forwarded-For/X-Real-Ip rather than appending to them, corrupting
// what req.ip resolves to.
const ip = getRequestHeader(req, AI_GATEWAY_CLIENT_IP_HEADER) || req.ip;
if (!ip) {
return { user: null, virtualApiKeyId: null };
}
@@ -965,7 +971,8 @@ export async function handleAiGatewayProxy(
"content-length",
"accept-encoding",
AI_GATEWAY_TRUST_HEADER.toLowerCase(),
AI_GATEWAY_RESOURCE_TYPE_HEADER.toLowerCase()
AI_GATEWAY_RESOURCE_TYPE_HEADER.toLowerCase(),
AI_GATEWAY_CLIENT_IP_HEADER.toLowerCase()
]);
const headers: Record<string, string> = {};