From a0364ac9f0d37410d4e39e4a5fc395f54286932e Mon Sep 17 00:00:00 2001 From: ralksta Date: Wed, 11 Mar 2026 23:36:40 +0100 Subject: [PATCH] fix: remove request.ip which was removed in Next.js 15+ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The request.ip property no longer exists on NextRequest in Next.js 15+. Fall back to x-real-ip (set by trusted reverse proxies) then x-forwarded-for. The security intent from PR #4 is preserved — x-real-ip is preferred over the more easily spoofed x-forwarded-for header. Fixes build error: Property 'ip' does not exist on type 'NextRequest' --- app/api/auth/route.ts | 5 +++-- app/api/image/[id]/route.ts | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/app/api/auth/route.ts b/app/api/auth/route.ts index dc7d20d..6202d96 100644 --- a/app/api/auth/route.ts +++ b/app/api/auth/route.ts @@ -12,9 +12,10 @@ const AUTH_RPM = 10; export async function POST(request: NextRequest) { // ── Rate limiting (brute-force protection) ────────── - // Security: Prioritize request.ip and x-real-ip to prevent x-forwarded-for spoofing + // Security: Prioritize x-real-ip (set by trusted reverse proxies like nginx/Traefik) + // over x-forwarded-for which can be spoofed by clients. + // Note: request.ip was removed in Next.js 15+. const ip = - request.ip ?? request.headers.get('x-real-ip') ?? request.headers.get('x-forwarded-for')?.split(',')[0].trim() ?? 'unknown'; diff --git a/app/api/image/[id]/route.ts b/app/api/image/[id]/route.ts index a5daac8..ae60889 100644 --- a/app/api/image/[id]/route.ts +++ b/app/api/image/[id]/route.ts @@ -26,9 +26,10 @@ function widthToSize(w: number): ImageSize { export async function GET(request: NextRequest, { params }: { params: Promise<{ id: string }> }) { // ── Rate limiting ────────────────────────────────── - // Security: Prioritize request.ip and x-real-ip to prevent x-forwarded-for spoofing + // Security: Prioritize x-real-ip (set by trusted reverse proxies like nginx/Traefik) + // over x-forwarded-for which can be spoofed by clients. + // Note: request.ip was removed in Next.js 15+. const ip = - request.ip ?? request.headers.get('x-real-ip') ?? request.headers.get('x-forwarded-for')?.split(',')[0].trim() ?? 'unknown';