fix(security): restore the X-Real-IP fallback for webhook allowlists

getAssertedOriginIp only read X-Forwarded-For, but the helper it replaced also
accepted X-Real-IP. A proxy that sets only X-Real-IP left the allowlist with no
address at all, so every permitted delivery 403'd.

Fall back to X-Real-IP when the forwarded chain yields nothing. It is the same
question the chain answers — which address does this delivery claim to come
from — and with no chain present it is the only record of the sender.

Author: waleedlatif1

packages/security/src/client-ip.test.ts

@@ -173,7 +173,20 @@ describe('getAssertedOriginIp', () => {
     )
   })
 
-  it('returns null when there is no forwarded chain or no address in it', () => {
+  it('falls back to x-real-ip for proxies that set it instead of a chain', () => {
+    expect(getAssertedOriginIp(req({ 'x-real-ip': '203.0.113.7' }))).toBe('203.0.113.7')
+    expect(
+      getAssertedOriginIp(req({ 'x-forwarded-for': 'unknown', 'x-real-ip': '203.0.113.7' }))
+    ).toBe('203.0.113.7')
+  })
+
+  it('prefers the forwarded chain over x-real-ip when both parse', () => {
+    expect(
+      getAssertedOriginIp(req({ 'x-forwarded-for': '203.0.113.7', 'x-real-ip': '10.0.0.1' }))
+    ).toBe('203.0.113.7')
+  })
+
+  it('returns null when no header yields an address', () => {
     expect(getAssertedOriginIp(req({}))).toBeNull()
     expect(getAssertedOriginIp(req({ 'x-forwarded-for': 'unknown' }))).toBeNull()
     expect(canonicalizeIp('not-an-ip')).toBeNull()

packages/security/src/client-ip.ts

@@ -170,12 +170,15 @@ export function resolveClientIp(
 
 /**
  * The **leftmost** `X-Forwarded-For` hop — the origin address *asserted* by the
- * caller — in canonical form, or `null` when none parses.
+ * caller — in canonical form, falling back to `X-Real-IP`, or `null` when
+ * neither header yields an address.
  *
  * Deliberately the opposite end of the chain from {@link resolveClientIp}, and
  * usable for exactly one thing: comparing against an operator-configured
  * allowlist of expected senders, where the question is "which address does this
- * delivery claim to come from" rather than "who do I throttle".
+ * delivery claim to come from" rather than "who do I throttle". The `X-Real-IP`
+ * fallback matters because a proxy may set it *instead of* a forwarded chain,
+ * and it is then the only record of the sender.
  *
  * **Never key a rate limit, quota, or lockout on this.** Under any proxy that
  * appends to `X-Forwarded-For` the value is caller-controlled and can be rotated
@@ -184,12 +187,12 @@ export function resolveClientIp(
  */
 export function getAssertedOriginIp(request: ClientIpHeaderSource): string | null {
   const forwarded = request.headers.get('x-forwarded-for')
-  if (!forwarded) return null
-  for (const hop of forwarded.split(',')) {
+  for (const hop of forwarded?.split(',') ?? []) {
     const addr = parseHop(hop)
     if (addr) return addr.toString()
   }
-  return null
+  const realIp = parseHop(request.headers.get('x-real-ip') ?? '')
+  return realIp ? realIp.toString() : null
 }
 
 /**