deedf8abb0
The remote_ip matcher was reading the X-Forwarded-For header by default, but this behavior was not documented in anything that was released. This is also a less secure default, as it is trivially easy to spoof request headers. Reading IPs from that header should be optional, and it should not be the default. This is technically a breaking change, but anyone relying on the undocumented behavior was just doing so by coincidence/luck up to this point since it was never in any released documentation. We'll still add a mention in the release notes about this. |
||
|---|---|---|
| .. | ||
| caddyhttp | ||
| caddypki | ||
| caddytls | ||
| filestorage | ||
| logging | ||
| metrics | ||
| standard | ||