{"record":{"id":"afea7436fec85c32","repo":"AdguardTeam/AdGuardHome","slug":"getting-remote-address-w","errorCode":null,"errorMessage":"getting remote address: %w","messagePattern":"getting remote address: %w","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"internal/home/authhttp.go","lineNumber":578,"sourceCode":"\n// userFromRequestBasicAuth searches for a user using Basic Auth credentials.  r\n// must not be nil.\nfunc (mw *authMiddlewareDefault) userFromRequestBasicAuth(\n\tctx context.Context,\n\tr *http.Request,\n) (user *aghuser.User, err error) {\n\tlogin, pass, ok := r.BasicAuth()\n\tif !ok {\n\t\treturn nil, nil\n\t}\n\n\tvar remoteIP string\n\t// The real IP address of the client [realIP] cannot be used here without\n\t// taking trusted proxies into account due to security issues:\n\t//\n\t// See https://github.com/AdguardTeam/AdGuardHome/issues/2799.\n\tif remoteIP, err = netutil.SplitHost(r.RemoteAddr); err != nil {\n\t\treturn nil, fmt.Errorf(\"getting remote address: %w\", err)\n\t}\n\n\trateLimiter := mw.rateLimiter\n\tif left := rateLimiter.check(remoteIP); left > 0 {\n\t\treturn nil, fmt.Errorf(\"login attempt blocked for %s\", left)\n\t}\n\n\tdefer func() {\n\t\tif err != nil {\n\t\t\trateLimiter.inc(remoteIP)\n\n\t\t\treturn\n\t\t}\n\n\t\trateLimiter.remove(remoteIP)\n\t}()\n\n\tuser, _ = mw.users.ByLogin(ctx, aghuser.Login(login))","sourceCodeStart":560,"sourceCodeEnd":596,"githubUrl":"https://github.com/AdguardTeam/AdGuardHome/blob/b41aefbe51c8dde65e2c50f093996afa0502edf9/internal/home/authhttp.go#L560-L596","documentation":"Basic-auth authentication failed before credential checking because the host part of r.RemoteAddr could not be extracted. netutil.SplitHost returned an error for the remote address string.","triggerScenarios":"userFromRequestBasicAuth on a request whose RemoteAddr is malformed (missing port, empty host, or non-IP content).","commonSituations":"Tests with fake RemoteAddr, exotic proxies or custom servers that don't set host:port correctly.","solutions":["Log and inspect r.RemoteAddr for the offending request","Fix the fronting proxy/server to supply a proper host:port RemoteAddr","Reproduce with a direct connection to rule out middleware mangling"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Log the raw RemoteAddr and return 400/500 without retrying auth","preventionTips":["In tests always set r.RemoteAddr = \"1.2.3.4:80\"","Ensure proxies terminate TCP properly so Go sets host:port"],"tags":["auth","basic-auth","network","ip-parsing"],"backgroundTag":"invalid-remote-address","analyzedSha":"b41aefbe51c8dde65e2c50f093996afa0502edf9","analyzedAt":"2026-08-27T04:57:55.097Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}