Phase 2: Fix high-priority security and stability issues (H1-H7)

H1: Sanitize error endpoint context (strip tokens/passwords, limit depth/size)
H2: Rate limiter IP spoofing fix (trusted proxy CIDR check for X-Forwarded-For)
H3: CSRF middleware uses Redis singleton instead of per-request connection
H4: WebSocket origin verification added to both kommunikation and ai_ui_control
H5: Storage path traversal protection, get_url() returns relative URL not filesystem path
H6: Security headers middleware (HSTS, X-Content-Type-Options, X-Frame-Options, CSP, Referrer-Policy)
H7: Forward-repair migration 0045 for databases that ran original 0021/0027

Also: add trusted_proxy_cidrs to config, add verify_ws_origin to auth

app/core/rate_limit.py

@@ -39,8 +39,38 @@ async def reset_rate_limit(redis_key: str) -> None:
 
 
 def get_client_ip(request: Request) -> str:
-    """Extract client IP from request."""
-    forwarded = request.headers.get("x-forwarded-for")
-    if forwarded:
-        return forwarded.split(",")[0].strip()
-    return request.client.host if request.client else "unknown"
+    """Extract client IP from request.
+
+    Only trusts X-Forwarded-For if the direct client is a trusted proxy
+    (configured via TRUSTED_PROXY_CIDRS env var, comma-separated CIDRs).
+    This prevents IP spoofing to bypass rate limits.
+    """
+    direct_ip = request.client.host if request.client else "unknown"
+
+    # Check if the direct client is a trusted proxy
+    from app.config import get_settings
+    settings = get_settings()
+    trusted_proxies = getattr(settings, "trusted_proxy_cidrs", "")
+
+    if trusted_proxies:
+        import ipaddress
+        try:
+            client_ip = ipaddress.ip_address(direct_ip)
+            for cidr in trusted_proxies.split(","):
+                cidr = cidr.strip()
+                if cidr and client_ip in ipaddress.ip_network(cidr, strict=False):
+                    # Trusted proxy — use X-Forwarded-For
+                    forwarded = request.headers.get("x-forwarded-for")
+                    if forwarded:
+                        # Use the leftmost (original client) IP
+                        return forwarded.split(",")[0].strip()
+                    # Fallback to X-Real-IP
+                    real_ip = request.headers.get("x-real-ip")
+                    if real_ip:
+                        return real_ip.strip()
+                    break
+        except (ValueError, TypeError):
+            pass
+
+    # Not a trusted proxy or no trusted proxies configured — use direct IP
+    return direct_ip