the files

static/Servers/Campus/Middleware/ClientIpMiddleware.cs

@@ -0,0 +1,45 @@
+using System.Net;
+
+namespace Campus_live_rewrite.Middleware
+{
+    /// <summary>
+    /// The player's real address, now that Cloudflare sits in front of Caddy.
+    ///
+    /// Every per-IP defence in this server (TrafficGuard, LoginGuard, the website sign-up limiter, bans, the IP allowlist) keys on the LAST
+    /// X-Forwarded-For entry, which used to be the player because Caddy appended the connecting peer. Behind Cloudflare the connecting peer is
+    /// a Cloudflare edge address, so every player on that edge would share one address: one abuser rate-limits, locks out or IP-bans thousands.
+    ///
+    /// Caddy (Deploy/harden-vps.sh, "cloudflare" mode) works the real address out itself - it only believes Cloudflare's CF-Connecting-IP
+    /// when the connection really comes from a Cloudflare range - and hands it to this server in <c>X-Campus-Client-IP</c>, REPLACING any value a
+    /// client sent. This middleware, first in the pipeline, copies that value into X-Forwarded-For (and CF-Connecting-IP, which some older code
+    /// reads first), so every existing check sees the real player without being touched.
+    ///
+    /// Trust: only a request whose socket peer is this machine (the proxy) is believed, and the header is only meaningful because Caddy
+    /// overwrites it on every request it forwards. Without that Caddy configuration the header is absent and nothing changes.
+    /// </summary>
+    public class ClientIpMiddleware
+    {
+        public const string Header = "X-Campus-Client-IP";
+        private readonly RequestDelegate _next;
+
+        public ClientIpMiddleware(RequestDelegate next) => _next = next;
+
+        public Task Invoke(HttpContext context)
+        {
+            var remote = context.Connection.RemoteIpAddress;
+            bool fromProxy = remote == null || IPAddress.IsLoopback(remote)
+                || (context.Connection.LocalIpAddress != null && remote.Equals(context.Connection.LocalIpAddress));
+            if (fromProxy && context.Request.Headers.TryGetValue(Header, out var v))
+            {
+                string ip = v.ToString().Trim();
+                if (IPAddress.TryParse(ip, out var parsed))
+                {
+                    ip = parsed.ToString();
+                    context.Request.Headers["X-Forwarded-For"] = ip;
+                    context.Request.Headers["CF-Connecting-IP"] = ip;
+                }
+            }
+            return _next(context);
+        }
+    }
+}