Real IP Leak

[creep247]

Problem:
The Real IP address of users is leaked via X-Forwarded-For header

Two options:
1- If there is no solution, Warn the users in readme file
2- find a solution to remove this header from requests

Thanks

[therealaleph]

Confirmed + fixed in commit 87c095c (just pushed to main).

What was happening: our filter_forwarded_headers (in src/domain_fronter.rs) was stripping hop-by-hop headers (Host, Connection, Content-Length, Transfer-Encoding, Proxy-*) but not identity-revealing forwarding headers. If a user sat behind a chained local proxy (xray, v2rayNG, corporate proxy) or ran a browser extension that inserts any of these, they'd pass through to Apps Script and on to the origin server carrying the client's real IP.

Full list now stripped from the Apps Script relay path:

• X-Forwarded-For, X-Forwarded-Host, X-Forwarded-Proto, X-Forwarded-Port, X-Forwarded-Server, X-Forwarded-Ssl
• Forwarded (RFC 7239)
• Via
• X-Real-IP, X-Client-IP, X-Originating-IP, True-Client-IP, Client-IP
• CF-Connecting-IP, Fastly-Client-IP, X-Cluster-Client-IP

Added a regression test (filter_forwarded_headers_strips_identity_revealing_headers) that locks every entry in.

Scope caveat — SNI-rewrite tunnel path: for targets we route via the direct SNI-rewrite tunnel (.google.com, .youtube.com, .gvt1.com, etc.), we do a raw TLS byte bridge — we don't parse HTTP at all, so any headers the browser emits pass through as opaque bytes to the Google Front End. In practice the origin only sees the GFE's IP, not the client's, because GFE terminates TLS and establishes a new connection to the backend. Still, if you specifically want to be extra paranoid for that path, use google_only mode with upstream_socks5 pointed at a VPS you control — that way even the outbound TCP comes from the VPS, not your home IP.

Will ship in the next tag (either tonight or in the morning, depending on release cadence batching).

---

_{[reply via Anthropic Claude | reviewed by @therealaleph]}

[therealaleph]

Shipped in v1.2.8 (commit 87c095c) — filter_forwarded_headers now strips every identity-revealing forwarding header (X-Forwarded-For, X-Real-IP, Forwarded, Via, CF-Connecting-IP, True-Client-IP, X-Client-IP, Fastly-Client-IP, X-Cluster-Client-IP, Client-IP, X-Originating-IP, X-Forwarded-Host/Proto/Port/Server/Ssl — 16 variants total) before the request hits Apps Script. Regression test filter_forwarded_headers_strips_identity_revealing_headers locks each one in. Current release is v1.2.12.

Closing as shipped. Reopen if you spot any other leak vector.

---

_{[reply via Anthropic Claude | reviewed by @therealaleph]}

[creep247]

in v1.2.13 there is still IP Leak. I see no difference. Is the problem in client or Code.gs ?