From 30573b616d4a2394d92648a0f6afd2aeabb1db36 Mon Sep 17 00:00:00 2001
From: Aly Raffauf <aly@aly.codes>
Date: Thu, 30 Jul 2026 01:44:47 -0400
Subject: [PATCH] bobbin/xrpc: forward X-Forwarded-For headers to knots

---
 bobbin/crates/xrpc/src/lib.rs          | 11 +++++++++--
 bobbin/crates/xrpc/tests/knot_proxy.rs |  7 ++++++-
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/bobbin/crates/xrpc/src/lib.rs b/bobbin/crates/xrpc/src/lib.rs
index fa1814f6..da3becfb 100644
--- a/bobbin/crates/xrpc/src/lib.rs
+++ b/bobbin/crates/xrpc/src/lib.rs
@@ -459,8 +459,15 @@ const PASSTHROUGH_HEADERS: &[&HeaderName] = &[
     &CONTENT_RANGE,
 ];
 
-const FORWARDED_REQUEST_HEADERS: &[&HeaderName] =
-    &[&RANGE, &IF_RANGE, &IF_NONE_MATCH, &IF_MODIFIED_SINCE];
+static X_FORWARDED_FOR: HeaderName = HeaderName::from_static("x-forwarded-for");
+
+const FORWARDED_REQUEST_HEADERS: &[&HeaderName] = &[
+    &RANGE,
+    &IF_RANGE,
+    &IF_NONE_MATCH,
+    &IF_MODIFIED_SINCE,
+    &X_FORWARDED_FOR,
+];
 
 const KNOT_HOST_PARAM: &str = "knot";
 const REPO_PARAM: &str = "repo";
diff --git a/bobbin/crates/xrpc/tests/knot_proxy.rs b/bobbin/crates/xrpc/tests/knot_proxy.rs
index d4bd032c..97601c7e 100644
--- a/bobbin/crates/xrpc/tests/knot_proxy.rs
+++ b/bobbin/crates/xrpc/tests/knot_proxy.rs
@@ -568,7 +568,7 @@ async fn does_not_inject_auth_or_atproto_proxy_headers() {
 }
 
 #[tokio::test]
-async fn forwards_range_and_conditional_request_headers() {
+async fn forwards_range_conditional_and_client_address_headers() {
     let h = Harness::new().await;
     let tid = "3jzfcijpj2z2d";
     h.mount_repo_record(&did("did:plc:limpet"), &rkey(tid), "kelp")
@@ -598,6 +598,7 @@ async fn forwards_range_and_conditional_request_headers() {
                 ("range", "bytes=0-99"),
                 ("if-none-match", "\"old\""),
                 ("if-modified-since", "Wed, 01 May 2026 00:00:00 GMT"),
+                ("x-forwarded-for", "203.0.113.42"),
             ],
         )
         .await;
@@ -620,6 +621,10 @@ async fn forwards_range_and_conditional_request_headers() {
         knot_call.headers.get("if-modified-since").unwrap(),
         "Wed, 01 May 2026 00:00:00 GMT",
     );
+    assert_eq!(
+        knot_call.headers.get("x-forwarded-for").unwrap(),
+        "203.0.113.42",
+    );
 }
 
 #[tokio::test]
-- 
2.51.2