Skip to content

docs: record v4 client IP security release and migration #3199

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vishr merged 1 commit into from
Oct 30, 2026
Merged

docs: record v4 client IP security release and migration #3199

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,11 +19,16 @@ patch releases of the latest v4 version; older 4.x releases
do not get backports. Echo v4 requires Go 1.26 or later; build with a Go release
that the Go team still supports.

Some fixes need configuration as well as an upgrade. The
Client IP defaults in the
[proxy](https://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36)
and [rate limiter](https://github.com/labstack/echo/security/advisories/GHSA-246p-cpwv-v3jq)
advisories require setting `Echo#IPExtractor` in v4: `echo.ExtractIPDirect()` when
there is no proxy, or a header extractor that trusts only your own proxies.
advisories are fixed in v4.16.3. Upgrade older v4 releases to the latest v4 release.
Without `Echo#IPExtractor`, v4.16.3 and v5 use the connection peer and ignore
forwarded client IP headers. Applications behind proxies must configure a header
extractor that trusts only their own proxies; otherwise, clients behind one proxy
share its address for rate limiting, access controls, and logging. See the
[v4 migration example](https://github.com/labstack/echo/blob/v4.16.3/README.md#client-ip-security-migration-since-v4163).
Before v4.16.3, configuring an appropriate `Echo#IPExtractor` remains the workaround.

Paid [Echo Support](https://echo.labstack.com/pro#support) buys maintainer time.
It does not buy earlier or private fixes.
Expand Down
Loading