From d66e65c77d0051c5472cfa27e9097ec59cfe0e36 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tymoteusz=20G=C5=82uch?= <gluchtymoteusz@gmail.com>
Date: Sun, 8 Nov 2026 03:02:55 +0100
Subject: [PATCH 1/2] fix: Allow ip headers

---
 internal/packages-api/headers.go      | 12 ++++++++++
 internal/packages-api/headers_test.go | 32 +++++++++++++++++++++++++++
 2 files changed, 44 insertions(+)

diff --git a/internal/packages-api/headers.go b/internal/packages-api/headers.go
index eddaf69..7e13cb8 100644
--- a/internal/packages-api/headers.go
+++ b/internal/packages-api/headers.go
@@ -28,10 +28,22 @@ var allowedSearchHeaders = map[string]struct{}{
 	"upgrade-insecure-requests": {},
 	"user-agent":                {},
 	"cf-connecting-ip":          {},
+	"cf-connecting-ipv6":        {},
+	"cf-pseudo-ipv4":            {},
+	"cf-ipcountry":              {},
 	"cf-ray":                    {},
 	"cf-visitor":                {},
 	"cdn-loop":                  {},
+	"forwarded":                 {},
+	"true-client-ip":            {},
+	"x-client-ip":               {},
+	"x-cluster-client-ip":       {},
+	"x-forwarded-for":           {},
+	"x-forwarded-host":          {},
+	"x-forwarded-port":          {},
 	"x-forwarded-proto":         {},
+	"x-original-forwarded-for": {},
+	"x-real-ip":                 {},
 }
 
 var developmentSearchHeaders = map[string]struct{}{
diff --git a/internal/packages-api/headers_test.go b/internal/packages-api/headers_test.go
index 67c03c6..4099947 100644
--- a/internal/packages-api/headers_test.go
+++ b/internal/packages-api/headers_test.go
@@ -20,3 +20,35 @@ func TestIsAllowedSearchHeaderAcceptsStandardHeaders(t *testing.T) {
 		t.Fatal("expected standard Accept header to be allowed")
 	}
 }
+
+func TestIsAllowedSearchHeaderAcceptsProxyIPHeaders(t *testing.T) {
+	t.Setenv("ENVIRONMENT", "production")
+	for _, header := range []string{
+		"Forwarded",
+		"True-Client-IP",
+		"X-Client-IP",
+		"X-Cluster-Client-IP",
+		"X-Forwarded-For",
+		"X-Forwarded-Host",
+		"X-Forwarded-Port",
+		"X-Forwarded-Proto",
+		"X-Original-Forwarded-For",
+		"X-Real-IP",
+		"CF-Connecting-IP",
+		"CF-Connecting-IPv6",
+		"CF-Pseudo-IPv4",
+		"CF-IPCountry",
+		"CF-Ray",
+		"CF-Visitor",
+		"CDN-Loop",
+	} {
+		t.Run(header, func(t *testing.T) {
+			if !isAllowedSearchHeader(header) {
+				t.Fatalf("expected %s header to be allowed", header)
+			}
+		})
+	}
+	if isAllowedSearchHeader("X-Unrecognized-Header") {
+		t.Fatal("expected unrecognized header to be rejected")
+	}
+}

From 2ee730d5c7da0cae4a6dbb54e818a9ee9bf1da7c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tymoteusz=20G=C5=82uch?= <gluchtymoteusz@gmail.com>
Date: Sun, 8 Nov 2026 03:03:34 +0100
Subject: [PATCH 2/2] chore: Update tag

---
 cmd/api-service/main.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cmd/api-service/main.go b/cmd/api-service/main.go
index a4fd6b1..5f99088 100644
--- a/cmd/api-service/main.go
+++ b/cmd/api-service/main.go
@@ -15,7 +15,7 @@ import (
 )
 
 // @title TrustPkg API
-// @version 2.0.0
+// @version 2.0.1
 // @description API for searching npm packages and their vulnerability data.
 // @BasePath /api
 // @schemes http https