[7ttp]

TL;DR

adds X-Forwarded-For and X-Real-IP to what the stack gateway sends upstream, so edge functions can see who is calling them

whats introduced?

the gateway now appends the client address to any incoming X-Forwarded-For chain and sets
X-Real-IP to the client address, the same way the legacy backend does

both the http path and the websocket upgrade path send them

a client sent X-Real-IP is always replaced or dropped, so callers cant spoof it through the gateway

visual rep

flowchart LR
  subgraph before
    A1[client] --> B1[stack gateway]
    B1 --> C1[edge function sees no client address]
  end
  subgraph now
    A2[client] --> B2[stack gateway]
    B2 --> D2{peer address known}
    D2 -->|yes| E2["append client to X-Forwarded-For<br/>set X-Real-IP to client"]
    D2 -->|no| F2[drop client sent X-Real-IP]
    E2 --> G2[http and websocket upstreams]
    F2 --> G2
    G2 --> H2[edge function sees the caller]
  end

Loading

ref

• closes: stack: the gateway sets no X-Forwarded-For or X-Real-IP, so Edge Functions cannot see the client IP #7275

[github-actions]

🤖 AI Review

Both independent reviews reported no findings. Verified the changed header handling, HTTP and WebSocket callers, and integration coverage against the surrounding code; no actionable issues found. Tests were not run because dependencies are unavailable.

Findings

No issues found.

Stats

Claude findings: 0 · Codex findings: 0 · Confirmed: 0 · Refuted: 0 · Uncertain: 0

---

Models: claude-opus-5-5 + gpt-6.1-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.

[Coly010]

LGTM, thanks!

[7ttp]

left the queue twice on the start.slim-images ghcr 429 flake, nothing from this diff

• fix just landed in feat(cli): fall back to ecr public for slim images (CLI-2874) #7350 so requeueing...