Explicitly forward visitor IP to downstream services

Shipped

March 23, 2026 at 1:50 AM UTC

Author

Kamo

Commit

bb04125

ForwardedHeaderFilter consumes X-Forwarded-For from the incoming request, so when APIService forwards to SecurityService via RestTemplate the header is missing. Now explicitly sets X-Forwarded-For and X-Real-IP on outbound requests using the original client IP from the inbound request.