1.0.34

src/routes/api/auth/login/+server.ts

@@ -13,10 +13,11 @@ import {
 } from '$lib/server/auth';
 import { getUser, getUserByUsername } from '$lib/server/db';
 import { auditAuth } from '$lib/server/audit';
+import { getClientIp } from '$lib/server/client-ip';
 
 // POST /api/auth/login - Authenticate user
 export const POST: RequestHandler = async (event) => {
-	const { request, cookies, getClientAddress } = event;
+	const { request, cookies } = event;
 	// Check if auth is enabled
 	if (!(await isAuthEnabled())) {
 		return json({ error: 'Authentication is not enabled' }, { status: 400 });
@@ -29,10 +30,9 @@ export const POST: RequestHandler = async (event) => {
 			return json({ error: 'Username and password are required' }, { status: 400 });
 		}
 
-		// Rate limiting by IP and username
-		const clientIp = request.headers.get('x-forwarded-for')?.split(',')[0]?.trim()
-			|| request.headers.get('x-real-ip')
-			|| getClientAddress();
+		// Rate-limit key derived from socket IP + username. See client-ip.ts
+		// for how XFF is handled (opt-in via TRUST_FORWARDED_HEADERS).
+		const clientIp = getClientIp(event);
 		const rateLimitKey = `${clientIp}:${username}`;
 
 		const { limited, retryAfter } = isRateLimited(rateLimitKey);

src/routes/api/auth/logout/+server.ts

@@ -3,6 +3,7 @@ import type { RequestHandler } from '@sveltejs/kit';
 import { destroySession } from '$lib/server/auth';
 import { authorize } from '$lib/server/authorize';
 import { auditAuth } from '$lib/server/audit';
+import { getClientIp } from '$lib/server/client-ip';
 
 // POST /api/auth/logout - End session
 export const POST: RequestHandler = async (event) => {
@@ -11,9 +12,7 @@ export const POST: RequestHandler = async (event) => {
 		// Get current user before destroying session for audit log
 		const auth = await authorize(cookies);
 		const username = auth.user?.username || 'unknown';
-		const clientIp = event.request.headers.get('x-forwarded-for')?.split(',')[0]?.trim()
-			|| event.request.headers.get('x-real-ip')
-			|| event.getClientAddress();
+		const clientIp = getClientIp(event);
 
 		await destroySession(cookies);
 		console.log(`[Auth] Logout: user=${username} ip=${clientIp}`);

src/routes/api/auth/oidc/callback/+server.ts

@@ -2,6 +2,7 @@ import { json, redirect } from '@sveltejs/kit';
 import type { RequestHandler } from '@sveltejs/kit';
 import { handleOidcCallback, createUserSession, isAuthEnabled } from '$lib/server/auth';
 import { auditAuth } from '$lib/server/audit';
+import { getClientIp } from '$lib/server/client-ip';
 
 // GET /api/auth/oidc/callback - Handle OIDC callback from IdP
 export const GET: RequestHandler = async (event) => {
@@ -17,10 +18,8 @@ export const GET: RequestHandler = async (event) => {
 	const error = url.searchParams.get('error');
 	const errorDescription = url.searchParams.get('error_description');
 
-	// Extract client IP for logging
-	const clientIp = event.request.headers.get('x-forwarded-for')?.split(',')[0]?.trim()
-		|| event.request.headers.get('x-real-ip')
-		|| event.getClientAddress();
+	// Extract client IP for logging.
+	const clientIp = getClientIp(event);
 
 	// Handle error from IdP
 	if (error) {