Merge remote-tracking branch 'origin/main' into fix/api-without-googlefix/api-without-google

1 files changed, 9 insertions, 0 deletions

diff --git a/apps/api/Security/ForwardedHeadersPolicy.cs b/apps/api/Security/ForwardedHeadersPolicy.cs
index 046ad56..776c1e4 100644
--- a/apps/api/Security/ForwardedHeadersPolicy.cs
+++ b/apps/api/Security/ForwardedHeadersPolicy.cs
@@ -6,11 +6,20 @@ using Microsoft.AspNetCore.HttpOverrides;
 
 namespace Progmasoft.Progmaweb.Api.Security;
 
+/// <summary>Decides which forwarded headers the API trusts.</summary>
+/// <remarks>
+/// The API listens on loopback behind Nginx and the Next.js server. Only those local proxies may state the client
+/// address, host and scheme; the authentication rate limiter depends on the client address being genuine.
+/// </remarks>
 internal static class ForwardedHeadersPolicy
 {
+    /// <summary>Number of proxy hops whose headers are read.</summary>
     internal const int MaximumForwardedHops = 1;
+    /// <summary>Addresses of the proxies that may send forwarded headers.</summary>
     internal static readonly IPAddress[] TrustedProxies = [IPAddress.Loopback, IPAddress.IPv6Loopback];
 
+    /// <summary>Applies the policy to the forwarded-headers middleware.</summary>
+    /// <param name="options">Options to configure.</param>
     public static void Configure(ForwardedHeadersOptions options)
     {
         options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedHost |