kashalls / kromgo Goto Github PK

The endpoint format seems to be more often used than the raw endpoint, leading me to believe we should default the format to the shields supported format.

When I wrote this 12 hours ago, I planned for most people to use an external source of ratelimiting like NGINX or Cloudflare. Some people are calling it tacky and overcomplicated, so I need to figure out a way to put it in the already condensed app.

I figured out how to middleware it, its just that its difficult to figure out what the real clients ip is for the sake of ratelimiting. You have to trust the proxy thats forwarding to the app to make sure it trusts the X-Forwarded-For or X-Real-Ip or CF-Connecting-IP, plus these IPs have a chance to be non-rfc compliant often having the forwarded ips seperated with commas like: 192.168.1.1,192,168.1.2,etc.

I guess I could set it up so that in the config, you have to specify which header to retrieve the connecting ip with? The http.Request.RemoteAddr in Go has been told to be very very unreliable as per stackoverflow.