From a61f5d6cca419fba01a2da5903c8a1fbf3ee2a40 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Thu, 13 Aug 2026 09:14:14 -0400
Subject: [PATCH] optionally stamp ip header

---
 main.go | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/main.go b/main.go
index 45b4be5..a89b84d 100644
--- a/main.go
+++ b/main.go
@@ -24,6 +24,7 @@ type Config struct {
 	TrustIP                     []string `json:"trustip,omitempty"`
 	DisableDefaultCFIPs         bool     `json:"disableDefaultCFIPs,omitempty"`
 	CustomIPHeader              string   `json:"customIPHeader,omitempty"`
+	RealIPHeader                string   `json:"realIpHeader,omitempty"`
 	RemoteUserIDHeader          string   `json:"remoteUserIdHeader,omitempty"`
 	RemoteVirtualApiKeyIDHeader string   `json:"remoteVirtualApiKeyIdHeader,omitempty"`
 	RemoteUserHeader            string   `json:"remoteUserHeader,omitempty"`
@@ -59,6 +60,7 @@ type Badger struct {
 	disableForwardAuth          bool
 	trustIP                     []*net.IPNet
 	customIPHeader              string
+	realIPHeader                string
 	remoteUserIDHeader          string
 	remoteVirtualApiKeyIDHeader string
 	remoteUserHeader            string
@@ -142,6 +144,7 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
 		accessTokenHeader:           config.AccessTokenHeader,
 		disableForwardAuth:          config.DisableForwardAuth,
 		customIPHeader:              config.CustomIPHeader,
+		realIPHeader:                config.RealIPHeader,
 		remoteUserIDHeader:          stringOrDefault(config.RemoteUserIDHeader, defaultRemoteUserIDHeader),
 		remoteVirtualApiKeyIDHeader: stringOrDefault(config.RemoteVirtualApiKeyIDHeader, defaultRemoteVirtualApiKeyIDHeader),
 		remoteUserHeader:            stringOrDefault(config.RemoteUserHeader, defaultRemoteUserHeader),
@@ -609,4 +612,15 @@ func (p *Badger) setIPHeaders(req *http.Request, realIP string) {
 		req.Header.Del(cfVisitor)
 		req.Header.Del(cfConnectingIP)
 	}
+
+	// realIPHeader is a non-standard header name (opt-in via config), set
+	// unconditionally on every request regardless of trust. It exists for
+	// deployments with another proxy between Badger and the backend that
+	// unconditionally overwrites X-Forwarded-For/X-Real-Ip instead of
+	// appending to them - a proxy like that has no reason to touch a header
+	// name it doesn't recognize, so this survives where the standard ones
+	// don't.
+	if p.realIPHeader != "" {
+		req.Header.Set(p.realIPHeader, realIP)
+	}
 }