{"record":{"id":"e46eef4ed17b8f21","repo":"OpenNHP/opennhp","slug":"loopback-peer-s-sent-malformed-x-real-ip-q","errorCode":null,"errorMessage":"loopback peer %s sent malformed X-Real-IP %q","messagePattern":"loopback peer (.+?) sent malformed X-Real-IP %q","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"endpoints/relay/relay.go","lineNumber":1172,"sourceCode":"\t// Parse the direct TCP peer first so we always have a port.\n\tpeerHost, peerPortStr, err := net.SplitHostPort(r.RemoteAddr)\n\tpeerIP := net.IPv4zero\n\tpeerPort := 0\n\tif err == nil {\n\t\tif ip := net.ParseIP(peerHost); ip != nil {\n\t\t\tpeerIP = ip\n\t\t}\n\t\t_, _ = fmt.Sscanf(peerPortStr, \"%d\", &peerPort)\n\t}\n\n\tif peerIP.IsLoopback() {\n\t\trealIP := strings.TrimSpace(r.Header.Get(\"X-Real-IP\"))\n\t\tif realIP == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"loopback peer %s sent no X-Real-IP header; check reverse proxy config\", r.RemoteAddr)\n\t\t}\n\t\tip := net.ParseIP(realIP)\n\t\tif ip == nil {\n\t\t\treturn nil, fmt.Errorf(\"loopback peer %s sent malformed X-Real-IP %q\", r.RemoteAddr, realIP)\n\t\t}\n\t\t// X-Real-IP carries no port; the proxy peer's port is\n\t\t// used so connection-tracking keys remain unique.\n\t\treturn &net.UDPAddr{IP: ip, Port: peerPort}, nil\n\t}\n\n\treturn &net.UDPAddr{IP: peerIP, Port: peerPort}, nil\n}\n","sourceCodeStart":1154,"sourceCodeEnd":1181,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/endpoints/relay/relay.go#L1154-L1181","documentation":"Raised by realClientAddr for a loopback peer whose X-Real-IP header is present but fails net.ParseIP — the header contains a value that is not a bare IP address (e.g. 'ip:port', a hostname, or junk appended by a misconfigured proxy).","triggerScenarios":"Thrown at endpoints/relay/relay.go:1172 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set X-Real-IP to the plain client IP only (nginx: proxy_set_header X-Real-IP $remote_addr)","Check for accidental concatenation of IP and port in the proxy template","Reload the reverse proxy after fixing the header"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}