fix: address CodeRabbit review feedback

- Rename unused trustedNets param to _ in ProxyCIDRAllowlist with doc comment
- Use consistent JSON error responses in proxy CIDR allowlist (matching registry)

commit: 66e4d1be508196e65c26311976aa7b8d553a7b72
author: bnema · 6mo ago · 2026-03-27 22:16 UTC
parent: bcbd4d9
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

2 files · +9 -3

M internal/adapters/in/http/middleware/cidr.go +6 -2


@@ -54,7 +54,9 @@ func RegistryCIDRAllowlist(allowedNets, trustedNets []*net.IPNet, log zerowrap.L
54	54		// This is used to ensure only trusted sources (e.g. Cloudflare edge IPs) can reach the
55	55		// proxy server, preventing direct-to-origin attacks that bypass CDN protections.
56	56		// An empty allowedNets slice is a no-op (all traffic passes through).
57		-	func ProxyCIDRAllowlist(allowedNets, trustedNets []*net.IPNet, log zerowrap.Logger) func(http.Handler) http.Handler {
	57	+	// Note: the second parameter is accepted for signature consistency with RegistryCIDRAllowlist
	58	+	// but is intentionally unused — this middleware validates the direct network peer, not forwarded IPs.
	59	+	func ProxyCIDRAllowlist(allowedNets, _ []*net.IPNet, log zerowrap.Logger) func(http.Handler) http.Handler {
58	60		return func(next http.Handler) http.Handler {
59	61		if len(allowedNets) == 0 {
60	62		return next

@@ -86,7 +88,9 @@ func ProxyCIDRAllowlist(allowedNets, trustedNets []*net.IPNet, log zerowrap.Logg
86	88		Str(zerowrap.FieldClientIP, remoteIP).
87	89		Msg("proxy access denied by origin IP allowlist")
88	90
89		-	http.Error(w, "Forbidden", http.StatusForbidden)
	91	+	w.Header().Set("Content-Type", "application/json")
	92	+	w.WriteHeader(http.StatusForbidden)
	93	+	_ = json.NewEncoder(w).Encode(dto.ErrorResponse{Error: "Forbidden"})
90	94		})
91	95		}
92	96		}

 // This is used to ensure only trusted sources (e.g. Cloudflare edge IPs) can reach the
 // proxy server, preventing direct-to-origin attacks that bypass CDN protections.
 // An empty allowedNets slice is a no-op (all traffic passes through).
-func ProxyCIDRAllowlist(allowedNets, trustedNets []*net.IPNet, log zerowrap.Logger) func(http.Handler) http.Handler {
+// Note: the second parameter is accepted for signature consistency with RegistryCIDRAllowlist
+// but is intentionally unused — this middleware validates the direct network peer, not forwarded IPs.
+func ProxyCIDRAllowlist(allowedNets, _ []*net.IPNet, log zerowrap.Logger) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		if len(allowedNets) == 0 {
 			return next
 				Str(zerowrap.FieldClientIP, remoteIP).
 				Msg("proxy access denied by origin IP allowlist")
-			http.Error(w, "Forbidden", http.StatusForbidden)
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusForbidden)
+			_ = json.NewEncoder(w).Encode(dto.ErrorResponse{Error: "Forbidden"})
 		})
 	}
 }

M internal/app/run.go +3 -1


@@ -1805,7 +1805,9 @@ func buildProxyCIDRAllowlistMiddleware(cfg Config, trustedNets []*net.IPNet, log
1805	1805		Str("host", r.Host).
1806	1806		Str(zerowrap.FieldClientIP, middleware.GetClientIP(r, trustedNets)).
1807	1807		Msg("proxy access denied due to invalid proxy_allowed_ips configuration")
1808		-	http.Error(w, "Forbidden", http.StatusForbidden)
	1808	+	w.Header().Set("Content-Type", "application/json")
	1809	+	w.WriteHeader(http.StatusForbidden)
	1810	+	_ = json.NewEncoder(w).Encode(dto.ErrorResponse{Error: "Forbidden"})
1809	1811		})
1810	1812		}
1811	1813		}

 					Str("host", r.Host).
 					Str(zerowrap.FieldClientIP, middleware.GetClientIP(r, trustedNets)).
 					Msg("proxy access denied due to invalid proxy_allowed_ips configuration")
-				http.Error(w, "Forbidden", http.StatusForbidden)
+				w.Header().Set("Content-Type", "application/json")
+				w.WriteHeader(http.StatusForbidden)
+				_ = json.NewEncoder(w).Encode(dto.ErrorResponse{Error: "Forbidden"})
 			})
 		}
 	}