The connector socket's client address is the right-most public X-Forwarded-For hop

Shipped

October 13, 2026 at 10:48 PM UTC

Author

Kamo

Commit

473cb6c

CameraAgentWebSocketHandler took the FIRST X-Forwarded-For hop — the one a client can write itself — and that address is what KamoCameraService rate-limits unauthenticated enrollment by. It now uses ClientIpResolver's rule (right-most public hop, else X-Real-IP, else the peer), via a new header-level ClientIpResolver.resolve(xff, realIp, remoteAddr) that the servlet overload delegates to. CameraAgentClientIpTest pins the spoofed-first-hop case. Suite: 205 tests green.