wip

app/Server/Http/Controllers/TunnelMessageController.php

@@ -81,6 +81,8 @@ class TunnelMessageController extends PostController
 
     protected function prepareRequest(Request $request, ControlConnection $controlConnection): Request
     {
+        $request::setTrustedProxies([$controlConnection->socket->remoteAddress], Request::HEADER_X_FORWARDED_ALL);
+
         $request->headers->set('Host', $controlConnection->host);
         $request->headers->set('X-Forwarded-Proto', $request->isSecure() ? 'https' : 'http');
         $request->headers->set('X-Expose-Request-ID', uniqid());