🐛 fix(proxy): Ensure BalancerForward overwrites X-Real-IP header by gaby · Pull Request #4260 · gofiber/fiber

gaby · 2026-05-07T04:05:10Z

Motivation

Prevent header spoofing by making the proxy set the X-Real-IP value instead of appending to any existing header.

Description

Replace Header.Add with Header.Set in BalancerForward to ensure the X-Real-IP header is overwritten.
Update the example in docs/middleware/proxy.md to use Header.Set for X-Real-IP consistency with runtime behavior.
Add Test_Proxy_Balancer_Forward_OverwritesXRealIP in middleware/proxy/proxy_test.go to assert that a pre-existing X-Real-IP header is not retained by the forwarded request.

coderabbitai · 2026-05-07T04:05:17Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 18892cac-d5ea-451d-83d7-61c8a208bd2e

📥 Commits

Reviewing files that changed from the base of the PR and between 186000e and 907306a.

📒 Files selected for processing (1)

middleware/proxy/proxy_test.go

🚧 Files skipped from review as they are similar to previous changes (1)

middleware/proxy/proxy_test.go

Walkthrough

This PR changes the proxy balancer to overwrite the X-Real-IP header using Header.Set (not Header.Add), adds a test verifying the overwrite behavior, and updates the documentation example to match.

Changes

X-Real-IP Header Overwrite

Layer / File(s)	Summary
Core Implementation `middleware/proxy/proxy.go`	`BalancerForward` switches from `Header.Add` to `Header.Set` for `X-Real-IP`, ensuring a single header value is forwarded.
Validation Tests `middleware/proxy/proxy_test.go`	New `Test_Proxy_Balancer_Forward_OverwritesXRealIP` sends a spoofed `X-Real-IP` and asserts the backend receives the overwritten value and returns 200.
Documentation `docs/middleware/proxy.md`	`proxy.Balancer` example `ModifyRequest` updated to use `Header.Set` for `X-Real-IP` instead of `Header.Add`.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Suggested reviewers

sixcolors
efectn
ReneWerner87

Poem

I nibble on headers under moonlight's glow,
I swap the spoofs so truth may show,
From many values to just one line,
The proxy hums tidy — neat and fine,
Hop, set, forward — rabbit's work is done. 🐇✨

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Description check	❓ Inconclusive	The PR description provides clear motivation, specific code changes, and documentation updates, but lacks the structured template sections and checklist items expected by the repository.	Consider filling out the repository's PR template with explicit sections (Changes introduced, Type of change, Checklist) to improve clarity and consistency.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: fixing the proxy middleware to overwrite the X-Real-IP header instead of appending to it.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix-x-real-ip-header-handling-in-balancerforward

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.1)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

Generate code and open pull requests
Plan features and break down work
Investigate incidents and troubleshoot customer tickets together
Automate recurring tasks and respond to alerts with triggers
Summarize progress and report instantly

Built for teams:

Shared memory across your entire org—no repeating context
Per-thread sandboxes to safely plan and execute work
Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

codecov · 2026-05-07T04:06:42Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.12%. Comparing base (40c0a52) to head (907306a).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4260      +/-   ##
==========================================
- Coverage   91.18%   91.12%   -0.07%     
==========================================
  Files         129      129              
  Lines       12749    12749              
==========================================
- Hits        11625    11617       -8     
- Misses        709      715       +6     
- Partials      415      417       +2

Flag	Coverage Δ
unittests	`91.12% <100.00%> (-0.07%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

gemini-code-assist

Code Review

This pull request updates the proxy middleware to use Header.Set instead of Header.Add for the X-Real-IP header, ensuring that incoming headers are correctly overwritten rather than appended. A new test case was added to verify this behavior. The reviewer suggested improving the robustness of the new test by using constants for IP addresses and asserting the exact expected IP value.

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

gaby · 2026-05-07T05:22:02Z

@copilot fix the unit tests for proxy middleware

Agent-Logs-Url: https://github.com/gofiber/fiber/sessions/806acfbb-3625-48d4-933f-662e8cedc55b Co-authored-by: gaby <835733+gaby@users.noreply.github.com>

Copilot · 2026-05-07T06:49:00Z

@copilot fix the unit tests for proxy middleware

Fixed in 2af51d2. I updated the proxy middleware unit test to use Fiber's app.Test client IP behavior so the X-Real-IP overwrite assertion passes reliably.

…ward

Copilot

Pull request overview

This PR hardens the proxy balancer forwarding path against header spoofing by ensuring the forwarded request’s X-Real-IP is overwritten (not appended), aligning documentation and adding a regression test.

Changes:

Update BalancerForward to use Header.Set for X-Real-IP instead of Header.Add.
Add a test ensuring a pre-existing X-Real-IP header is not retained when forwarding.
Update the proxy middleware docs example to use Header.Set for consistency.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
middleware/proxy/proxy.go	Overwrites `X-Real-IP` during balancer forwarding to prevent retaining spoofed values.
middleware/proxy/proxy_test.go	Adds regression coverage asserting `X-Real-IP` is not appended/duplicated when forwarding.
docs/middleware/proxy.md	Updates example to match runtime behavior (`Header.Set` for `X-Real-IP`).

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

📒 docs: align proxy header example with secure X-Real-IP overwrite

a1f20a6

gaby added the codex label May 7, 2026 — with ChatGPT Codex Connector

ReneWerner87 added v3 ✏️ Feature 📒 Documentation 🧹 Updates labels May 7, 2026

ReneWerner87 added this to v3 May 7, 2026

ReneWerner87 added this to the v3 milestone May 7, 2026

gaby changed the title ~~Ensure BalancerForward overwrites X-Real-IP header and update docs; add test~~ 🐛 fix(proxy): Ensure BalancerForward overwrites X-Real-IP header May 7, 2026

ReneWerner87 added the ☢️ Bug label May 7, 2026

gemini-code-assist Bot reviewed May 7, 2026

View reviewed changes

Comment thread middleware/proxy/proxy_test.go Outdated

gaby removed 📒 Documentation ✏️ Feature 🧹 Updates labels May 7, 2026

gaby moved this to In Progress in v3 May 7, 2026

Update middleware/proxy/proxy_test.go

fa1c538

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Copilot started work on behalf of gaby May 7, 2026 06:40 View session

Copilot AI and others added 2 commits May 7, 2026 06:42

test(proxy): align X-Real-IP assertion with app.Test client IP

2cdf90f

Agent-Logs-Url: https://github.com/gofiber/fiber/sessions/806acfbb-3625-48d4-933f-662e8cedc55b Co-authored-by: gaby <835733+gaby@users.noreply.github.com>

test(proxy): clarify app.Test client IP expectation

2af51d2

Agent-Logs-Url: https://github.com/gofiber/fiber/sessions/806acfbb-3625-48d4-933f-662e8cedc55b Co-authored-by: gaby <835733+gaby@users.noreply.github.com>

Copilot finished work on behalf of gaby May 7, 2026 06:50

Merge branch 'main' into fix-x-real-ip-header-handling-in-balancerfor…

186000e

…ward

gaby marked this pull request as ready for review May 7, 2026 13:54

gaby requested a review from a team as a code owner May 7, 2026 13:54

gaby requested review from ReneWerner87, Copilot and sixcolors May 7, 2026 13:54

gaby requested a review from efectn May 7, 2026 13:54

Copilot started reviewing on behalf of gaby May 7, 2026 13:55 View session

Copilot AI reviewed May 7, 2026

View reviewed changes

Comment thread middleware/proxy/proxy_test.go Outdated

Potential fix for pull request finding

907306a

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

ReneWerner87 approved these changes May 8, 2026

View reviewed changes

ReneWerner87 merged commit 1403cc8 into main May 8, 2026
21 of 22 checks passed

ReneWerner87 deleted the fix-x-real-ip-header-handling-in-balancerforward branch May 8, 2026 07:10

github-project-automation Bot moved this from In Progress to Done in v3 May 8, 2026

Claude AI mentioned this pull request May 8, 2026

🐛 bug: Add X-Real-IP protection to Forward and DomainForward variants #4261

Merged

9 tasks

ReneWerner87 modified the milestones: v3, v3.3.0 May 22, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

🐛 fix(proxy): Ensure BalancerForward overwrites X-Real-IP header#4260

🐛 fix(proxy): Ensure BalancerForward overwrites X-Real-IP header#4260
ReneWerner87 merged 6 commits into
mainfrom
fix-x-real-ip-header-handling-in-balancerforward

gaby commented May 7, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented May 7, 2026 •

edited

Loading

❌ Failed checks (1 warning, 1 inconclusive)

Uh oh!

codecov Bot commented May 7, 2026 •

edited

Loading

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

gaby commented May 7, 2026

Uh oh!

Copilot AI commented May 7, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

gaby commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Description

Uh oh!

coderabbitai Bot commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Suggested reviewers

Poem

❌ Failed checks (1 warning, 1 inconclusive)

Uh oh!

codecov Bot commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

gaby commented May 7, 2026

Uh oh!

Copilot AI commented May 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

gaby commented May 7, 2026 •

edited

Loading

coderabbitai Bot commented May 7, 2026 •

edited

Loading

codecov Bot commented May 7, 2026 •

edited

Loading