Fix remote IP, fix title

backend/internal/auth/handler.go

@@ -1,10 +1,33 @@
 package auth
 
 import (
+	"net"
 	"net/http"
+	"strings"
 	"time"
 )
 
+// ExtractIP resolves the client's IP address from a request, accounting for the
+// reverse proxy in front of the backend. When the proxy forwards the original
+// address (X-Forwarded-For / X-Real-IP) the leftmost value is used; otherwise it
+// falls back to the connection's remote address.
+func ExtractIP(r *http.Request) string {
+	if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
+		ips := strings.Split(xff, ",")
+		return strings.TrimSpace(ips[0])
+	}
+
+	if realIP := r.Header.Get("X-Real-IP"); realIP != "" {
+		return realIP
+	}
+
+	ip, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		return r.RemoteAddr
+	}
+	return ip
+}
+
 func SigninSetup(w http.ResponseWriter, cookieName, cookieValue string, expiresAt time.Time, secure bool) {
 	maxAge := expiresAt.Sub(time.Now().UTC())
 	http.SetCookie(w, &http.Cookie{

backend/internal/rest/context.go

@@ -2,7 +2,6 @@ package rest
 
 import (
 	"fmt"
-	"net"
 	"net/http"
 
 	"goAuth/internal/auth"
@@ -27,14 +26,6 @@ func sessionFromRequest(r *http.Request) *auth.Session {
 	return session
 }
 
-func clientAddress(r *http.Request) string {
-	host, _, err := net.SplitHostPort(r.RemoteAddr)
-	if err != nil {
-		return r.RemoteAddr
-	}
-	return host
-}
-
 func formatUserId(id int64) string {
 	return fmt.Sprintf("user-%d", id)
 }

backend/internal/rest/handler_auth.go

@@ -39,7 +39,7 @@ func (h *Handler) signup(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	address := clientAddress(r)
+	address := auth.ExtractIP(r)
 	device := h.sessions.ClassifiedUserAgent(r.UserAgent())
 
 	u, session, err := h.sessions.RegisterUser(r.Context(), req.Login, req.Password, req.Invite, address, device)
@@ -64,7 +64,7 @@ func (h *Handler) signin(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	address := clientAddress(r)
+	address := auth.ExtractIP(r)
 	device := h.sessions.ClassifiedUserAgent(r.UserAgent())
 
 	u, session, err := h.sessions.LoginUser(r.Context(), req.Login, req.Password, address, device, req.Remember)