Use code recommendation

Author: OStefan2001

config/autoload/ip-address.global.php

@@ -13,15 +13,26 @@
 //     ],
 // ];
 
+// @see https://github.com/akrabat/ip-address-middleware/blob/main/src/IpAddress.php
 return [
     'rka' => [
         'ip_address' => [
+            // Inspect proxy headers below instead of using REMOTE_ADDR only.
             'check_proxy_headers' => true,
-            'trusted_proxies'     => [],
-            'attribute_name'      => 'ip_address',
-            'headers_to_inspect'  => [
-                'Forwarded',
+            // Proxy IPs/CIDRs/wildcards trusted to set the headers below.
+            'trusted_proxies' => [],
+            // Request attribute the resolved IP is stored under.
+            'attribute_name' => 'ip_address',
+            // Headers checked, in order, for the client IP.
+            'headers_to_inspect' => [
+                // nginx specific
+                'X-Real-IP',
                 'X-Forwarded-For',
+                // cloudflare specific
+                'CF-Connecting-IP',
+                'True-Client-IP',
+                // generic
+                'Forwarded',
                 'X-Forwarded',
                 'X-Cluster-Client-Ip',
                 'Client-Ip',

config/pipeline.php

@@ -13,7 +13,6 @@
 use Mezzio\Router\Middleware\ImplicitOptionsMiddleware;
 use Mezzio\Router\Middleware\MethodNotAllowedMiddleware;
 use Mezzio\Router\Middleware\RouteMiddleware;
-use RKA\Middleware\IpAddress;
 
 return function (Application $app): void {
     // The error handler should be the first (most outer) middleware to catch
@@ -64,8 +63,6 @@
     // - route-based validation
     // - etc.
 
-    $app->pipe(IpAddress::class);
-
     // Register the dispatch middleware in the middleware pipeline
     $app->pipe(DispatchMiddleware::class);
 

src/App/src/RoutesDelegator.php

@@ -13,6 +13,7 @@
 use Light\App\Handler\PostCreateContactHandler;
 use Mezzio\Application;
 use Psr\Container\ContainerInterface;
+use RKA\Middleware\IpAddress;
 
 use function assert;
 
@@ -28,7 +29,7 @@ public function __invoke(ContainerInterface $container, string $serviceName, cal
         $app->get('/{categorySlug}/{slug}.md', [GetMarkdownArticleHandler::class], 'app::markdown-article');
 
         $app->get('/contact/', [GetCreateContactFormHandler::class], 'app::create-contact-form');
-        $app->post('/contact/', [PostCreateContactHandler::class], 'app::create-contact');
+        $app->post('/contact/', [IpAddress::class, PostCreateContactHandler::class], 'app::create-contact');
 
         // Route name kept as `page::…` because `@layout/default.html.twig` links it by name.
         // The matching entry must stay out of `routes.page` in local.php to avoid a duplicate.

test/Unit/App/RoutesDelegatorTest.php

@@ -19,6 +19,7 @@
 use Psr\Container\ContainerExceptionInterface;
 use Psr\Container\ContainerInterface;
 use Psr\Container\NotFoundExceptionInterface;
+use RKA\Middleware\IpAddress;
 
 class RoutesDelegatorTest extends UnitTest
 {
@@ -77,7 +78,10 @@ public function testWillRegisterAllRoutes(): void
         $this->assertSame([GetCreateContactFormHandler::class], $this->registeredRoutes['/contact/']['handler']);
         $this->assertSame('app::create-contact-form', $this->registeredRoutes['/contact/']['name']);
 
-        $this->assertSame([PostCreateContactHandler::class], $this->registeredRoutes['POST /contact/']['handler']);
+        $this->assertSame(
+            [IpAddress::class, PostCreateContactHandler::class],
+            $this->registeredRoutes['POST /contact/']['handler']
+        );
         $this->assertSame('app::create-contact', $this->registeredRoutes['POST /contact/']['name']);
     }
 }