AdguardTeam/AdGuardHome · error

getting remote address

Error message

getting remote address: %w

What it means

Basic-auth authentication failed before credential checking because the host part of r.RemoteAddr could not be extracted. netutil.SplitHost returned an error for the remote address string.

Solutions

1. Log and inspect r.RemoteAddr for the offending request
2. Fix the fronting proxy/server to supply a proper host:port RemoteAddr
3. Reproduce with a direct connection to rule out middleware mangling

// Log the raw RemoteAddr and return 400/500 without retrying auth

When it happens

Trigger: userFromRequestBasicAuth on a request whose RemoteAddr is malformed (missing port, empty host, or non-IP content).

Common situations: Tests with fake RemoteAddr, exotic proxies or custom servers that don't set host:port correctly.

Related errors

• auth: parsing remote address
• login attempt blocked for
• auth: blocked for
• cannot get network interfaces
• checking static ip

AI-assisted analysis of AdguardTeam/AdGuardHome@b41aefbe51 (2026-08-27). Data as JSON: /api/errors/afea7436fec85c32. Report an issue: GitHub.

Appendix: source

Thrown at internal/home/authhttp.go:578

// userFromRequestBasicAuth searches for a user using Basic Auth credentials.  r
// must not be nil.
func (mw *authMiddlewareDefault) userFromRequestBasicAuth(
	ctx context.Context,
	r *http.Request,
) (user *aghuser.User, err error) {
	login, pass, ok := r.BasicAuth()
	if !ok {
		return nil, nil
	}

	var remoteIP string
	// The real IP address of the client [realIP] cannot be used here without
	// taking trusted proxies into account due to security issues:
	//
	// See https://github.com/AdguardTeam/AdGuardHome/issues/2799.
	if remoteIP, err = netutil.SplitHost(r.RemoteAddr); err != nil {
		return nil, fmt.Errorf("getting remote address: %w", err)
	}

	rateLimiter := mw.rateLimiter
	if left := rateLimiter.check(remoteIP); left > 0 {
		return nil, fmt.Errorf("login attempt blocked for %s", left)
	}

	defer func() {
		if err != nil {
			rateLimiter.inc(remoteIP)

			return
		}

		rateLimiter.remove(remoteIP)
	}()

	user, _ = mw.users.ByLogin(ctx, aghuser.Login(login))

View on GitHub (pinned to b41aefbe51)